Information Security
Management System

This Policy applies to information in any form, including electronic records, emails, communications, documents, paper files, images, audio, credentials, system logs and backups. It applies to directors, employees, trainees, consultants, business partners, vendors and other persons who access Vestigo information or systems, to the extent relevant to their role or contract.

Management is responsible for establishing oversight, assigning security responsibilities, providing reasonable resources, approving policies and monitoring material information-security risks. Business and technology owners are accountable for risks within their functions. Every authorised user is responsible for complying with security requirements, protecting credentials and promptly reporting suspected incidents.
Security policies, risk assessments and material controls will be reviewed periodically and following significant legal, regulatory, technological, operational or threat changes. Independent review, internal audit or external assessment may be undertaken where appropriate.

Vestigo classifies and handles information according to its sensitivity, business value and legal or contractual requirements. Confidential, personal, medical, financial, claims, KYC, credential and regulatory information is subject to enhanced access, transfer, storage, retention and disposal controls. Information must not be copied, transmitted, downloaded, printed or disclosed except for an authorised business purpose and through approved means.

Vestigo applies risk-appropriate controls to networks, devices, applications and infrastructure. These may include secure configuration, anti-malware, firewalls, endpoint protection, patching, vulnerability management, email security, encryption, secure remote access, backup, monitoring and restrictions on removable media or unauthorised software. Technology changes and new information-processing facilities are subject to appropriate review and approval.

Vestigo maintains logs and monitoring appropriate to its systems, risk profile and applicable legal requirements. Security events may be reviewed to detect unauthorised activity, malware, data leakage, account compromise, fraud or operational failure. Logs are protected against unauthorised alteration and retained for the period required by applicable law, regulatory direction, investigation or business need.

Vestigo applies reasonable physical safeguards to premises, work areas, records, equipment and visitor access. Confidential papers and media must be stored securely and disposed of through approved destruction methods. Unattended screens, portable devices and documents must be protected against unauthorised viewing, theft or loss.

All suspected cyber incidents, data breaches, malware, phishing, lost devices, unauthorised disclosure, credential compromise, fraud or security weaknesses must be reported immediately through approved channels. Vestigo will triage, contain, preserve evidence, investigate, remediate and document incidents and will cooperate with insurers, clients, service providers, law-enforcement and regulators as required.
Where applicable, Vestigo will make notifications or reports to CERT-In, IRDAI, the Data Protection Board of India, affected clients or individuals, and other competent authorities within legally prescribed timeframes. No employee or third party may conceal an incident, make an unauthorised public statement, or destroy relevant evidence.

Compliance with this Policy may be monitored through reviews, audits, testing, vulnerability assessment, incident analysis and management reporting. Exceptions must be documented, risk-assessed, time-bound and authorised. Violations may result in disciplinary, contractual, civil, regulatory or criminal consequences, depending on the circumstances.

This is a public statement of Vestigo’s information-security commitments. Detailed control configurations, network architecture and internal procedures are confidential and are not disclosed through this website. Publication of this Policy does not represent that Vestigo holds any particular external certification unless expressly stated elsewhere with current evidence. This Policy may be updated to reflect changes in risk, law, regulation, technology or business operations.