Security at Talyvance

01Security by design

Security starts in discovery, not after launch. We map how data moves through a system, identify likely threats and agree security requirements with you before the first sprint, so they are planned and tested like any other feature.

We use the OWASP Application Security Verification Standard as a baseline and raise the bar for regulated and security products, such as the identity, certificate and detection platforms in our case studies.

02Code and delivery

• Every change is peer reviewed before it is merged.
• Automated tests and static analysis run in continuous integration on every change.
• Third-party dependencies are tracked and updated when vulnerabilities are published.
• Releases are repeatable and traceable, with the ability to roll back.

03Access and secrets

• People get the least access they need for the work, and it is removed when they leave a project.
• Multi-factor authentication protects source control, cloud and communication accounts.
• Credentials and keys are kept in dedicated secret stores, separated by environment and rotated.

04Your code and data

• Where possible we work inside environments and accounts you own and control.
• Production data is not used in development or testing unless it has been anonymised.
• Data is encrypted in transit, and at rest wherever the platform supports it.
• We sign confidentiality agreements, and code ownership follows our agreement with you.

05Incident response

If we become aware of a security incident affecting your project or data, we will contain it, tell you promptly with what we know, and work with you on remediation and any notifications you need to make.

06Reporting a vulnerability

If you believe you have found a security issue in this website or anything we operate, please email [email protected] with the subject “Security report”. Include enough detail for us to reproduce it.

Please give us reasonable time to fix the issue before sharing it publicly, and don't access data that isn't yours or disrupt our services. We will acknowledge your report and keep you updated. Our contact details are also published in security.txt.

07Company and registrations

Talyvance (Private) Limited is a legally registered company with its office in Islamabad, Pakistan:

• Company registration: Securities and Exchange Commission of Pakistan (SECP)
• Tax registration: Federal Board of Revenue (FBR), NTN K475560

Registration documents are available to clients and procurement teams on request.

08Security reviews

We are happy to complete your security questionnaire and walk your team through our practices during procurement. Contact [email protected] to start a review.