Security

Our posture

We would rather tell you precisely what we do than describe our security in adjectives.

This page sets out how this website is secured, how security works in the software we deliver, and how to report a problem to us. Everything here is either certified, contractual, or directly verifiable.

Certifications

• ISO/IEC 27001:2013 for information security management.
• ISO 9001:2015 for quality management.

Clients who need certificate copies, scope statements, or our answers to a security questionnaire can request them at hello@agiletech.vn.

How this website is built

The most reliable way to reduce a website's attack surface is to give it less to do. This one does very little.

• Served over HTTPS. All traffic is encrypted in transit.
• No third-party scripts. No analytics, no tag manager, no advertising pixel, no chat widget. Every line of JavaScript on this site is served from our own origin, so there is no third party who could change what runs in your browser. A supply chain attack needs a supply chain.
• One embedded frame, and it is opt-in. The Google map on the Contact page is the site's only third-party frame. It is never served as a frame: the page carries an inert attribute and a panel we drew ourselves, and a frame is created only after you allow External content in Cookie settings or press Load map. A frame that does not exist cannot be exploited, and the build fails if a live frame is ever committed.
• Self-hosted fonts. Our typefaces load from our own origin, so no font network sees your visit.
• One cookie, and no browser storage. The only thing written to your device is the record of the cookie choice you made yourself, and it is written only once you have answered. Nothing is written to local storage or session storage. See the Cookie Policy.
• Security headers on every response, including X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, and a Permissions-Policy that disables camera, microphone, and geolocation.
• Two input surfaces. The contact form and the newsletter form are the only places the site accepts data. Every field on both is length-limited and validated on the server, whether or not the form marks it as required, and the email address is format-checked before anything is stored. The newsletter topic is checked against the fixed list the form offers, so nothing else can be written into that field.
• Parameterised database access. Enquiries are written using bound statement parameters rather than assembled strings, so form input cannot alter the query.
• Edge delivery. The site runs on a globally distributed edge platform rather than a single origin server, which absorbs ordinary volumetric abuse.

Security in how we deliver software

For client projects, security is part of the delivery process rather than a phase at the end.

• Security requirements are captured alongside functional ones during discovery, including data classification, retention, and regulatory obligations.
• Code review is mandatory before merge, and reviewers look for authorisation and input-handling defects, not only correctness.
• Dependencies are tracked and updated, and known-vulnerable packages are treated as defects.
• Secrets are held in managed secret stores, never in source control.
• Environments are separated, and production access is restricted and logged.
• Our security testing practice covers authentication and authorisation, injection, access control, and configuration weaknesses.
• Regulated work carries the evidence the regime requires, for example auditable records for financial systems and appropriate safeguards for health data.

Where we process personal data on a client's behalf, we do so under a data processing agreement meeting GDPR Article 28, as described in the Privacy Policy.

People and access

• All staff are bound by written confidentiality obligations.
• Access to client systems and data is granted on a need-to-know basis and removed when a person leaves a project or the company.
• Security awareness training is part of our certified management system.
• Client-specific requirements, including background checks, dedicated environments, and restricted-access teams, can be agreed in the engagement contract.

Reporting a vulnerability

If you have found a security problem in this website or in something we operate, please tell us. We will not pursue you for reporting it in good faith.

Email hello@agiletech.vn with "Security" in the subject line. Please include what you found, how to reproduce it, and what impact you think it has.

What we ask of you:

• Give us a reasonable opportunity to fix the issue before disclosing it publicly.
• Do not access, modify, or delete data that is not yours, and stop as soon as you have confirmed the issue exists.
• Do not run denial of service tests, send spam, or use social engineering against our staff or clients.

What you can expect from us: acknowledgement within five working days, an honest assessment of severity, and an update when it is fixed. We are glad to credit you if you would like that.

If the issue is in a system we built for a client, that client operates it. Tell us anyway and we will route the report to them promptly.

What we are not claiming

Being clear about the boundary is part of being trustworthy.

• We do not hold a SOC 2 report, and we do not claim one.
• We do not publish uptime guarantees for this marketing website. Availability commitments for client systems live in the relevant service agreement.
• No system is perfectly secure. If we suffer a personal data breach affecting you, we will notify you and the relevant authority as described in the Privacy Policy.

Contact

• Security reports and questions hello@agiletech.vn
• Phone (+84) 989 324 830