Security Exhibit
Security Exhibit / Security Whitepaper
Document ID: HM-LEGAL-004
Title: Security Exhibit
Version: 1.0-draft
Last updated: 2026-06-14
Publisher: Headshot Marketing Private Limited (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/headshotmarketing/HM-LEGAL-004
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the HeadshotMarketing subgroup at https://burdenoff.com/contracts/headshotmarketing/. Every referenced contract is identified by its Document ID (HM-LEGAL-### / HM-PRICING-###) and incorporated by reference.
Status: TEMPLATE / DRAFT — to be reconciled with the live infra-specs and security findings before customer publication. See HM-LEGAL-REG — Open Questions & Risks Register (Q-SEC-*). Incorporated by reference into the MSA, DPA, and Order Forms unless explicitly varied.
1. Overview
HeadshotMarketing is a multi-tenant SaaS marketing platform processing contact, lead, CRM, engagement and (where connected) ad/social data. HeadshotMarketing designs and operates the Service following defence-in-depth principles across (a) cloud infrastructure, (b) container platform, (c) application code, (d) data layer, (e) operator access, and (f) supply chain, with heightened controls around sensitive contact data.
Operating model. HeadshotMarketing is the contracting party. The Burdenoff Group's manpower house — Burdenoff Consultancy Services Private Limited — employs the engineering, support, security, and operations personnel that operate the Service under HeadshotMarketing's instructions and the Group's intra-group confidentiality and data-protection arrangements. Data and compute run on managed cloud services (Amazon Web Services, ap-south-1 Mumbai) acting as Subprocessors per DPA Annex 3.
Platform reuse. HeadshotMarketing runs on the shared Burdenoff platform and reuses common platform services (identity/RBAC, files/documents, tags, comments/threads, tenancy, billing, notifications). It inherits the platform's tenant isolation, RBAC and security model.
This Exhibit describes the controls in force. Specific commitments (e.g., RPO/RTO, retention, residency, customer-managed keys, marketing-data localisation) are set on the Order Form. No certification beyond what is expressly listed here is claimed; ISO/IEC 27001 and SOC 2 Type II are on the roadmap and not in force at the date of this Exhibit.
2. Organisational controls
- ISO/IEC 27001-aligned ISMS (certification roadmap — see Risks).
- Information Security Lead reporting to senior management.
- Security risk register reviewed quarterly.
- Documented policies for access control, asset management, change management, incident response, business continuity, vendor management, secure development, acceptable use.
- Mandatory annual security and privacy training, including secure handling of contact, CRM and engagement data; phishing simulations.
3. Personnel
- Confidentiality undertakings on all employees and contractors.
- Background checks for roles with production access, subject to local law.
- Access revocation within 24 hours of offboarding.
- Separation of duties for production change deployment vs. approval.
4. Identity and access management
| Layer | Control |
|---|---|
| Internal SSO | SSO with MFA mandatory; no shared accounts |
| Cloud admin | MFA enforced on AWS root and admin; single sign-on for operators |
| Production | RBAC, Cloudflare Zero Trust + bastion; just-in-time elevation |
| Secrets | AWS Secrets Manager per environment; access scoped by role |
| Customer-facing | RBAC enforced at the gateway via GraphQL @rbac directives; heightened restrictions on contact/CRM/engagement data; SSO/SAML/OIDC and SCIM available on Enterprise |
5. Encryption
| Data state | Mechanism |
|---|---|
| In transit | TLS 1.2+ on all public endpoints; HSTS; mTLS between internal services where supported |
| At rest | AES-256 for primary databases (PostgreSQL, graph database), managed cache (where supported), object storage |
| Application-layer | Signing keys and tenant secrets encrypted with AES-256-GCM |
| Key management | AWS KMS and Secrets Manager per environment; rotation policies; customer-managed keys available on Enterprise |
6. Network architecture
- Production runs on AWS EKS (Kubernetes) per environment with private networking and environment segregation.
- Public traffic: Cloudflare WAF → API gateways (GraphQL Yoga + Apollo Federation v2).
- Internal-only traffic: internal API gateways behind private ingress; M2M via internal gateways only.
- Default-deny network policies; egress restricted to approved destinations.
7. Application security
- Secure SDLC: PR review, GitHub Actions CI with AWS OIDC roles (no long-lived cloud keys in CI).
- Static analysis on CI; dependency scanning; secret scanning.
- Build-time container scanning with Trivy (CVEs, IaC misconfig, SBOM).
- Image scanning in Amazon ECR; a failing scan blocks the release.
- Strict input validation; GraphQL query depth/cost limits and RBAC at gateway; parameterised DB access via Prisma.
- Strict TypeScript; no
any, noeslint-disable, no@ts-ignorein repo standards.
8. Multi-tenancy and data isolation
- Logical tenant isolation by organisation / workspace ID; RBAC enforcement at the resolver layer.
- Heightened access controls around contact, CRM and engagement data.
- Storage and API request quotas applied per account.
- Dedicated tenant deployment available on Enterprise.
9. Logging, monitoring, audit
- Centralised logs, metrics and traces with dashboards.
- Customer-visible audit history per Plan; marketing-relevant actions (record edits, campaign changes, asset access) are auditable; longer retention for Enterprise.
- Security event monitoring with on-call rotation (best-effort outside business hours for non-Enterprise tiers).
- Burdenoff Group status page at https://status.burdenoff.com publishes uptime and incident status for all Burdenoff Group products, including HeadshotMarketing.
10. Vulnerability and patch management
- Continuous CVE scanning of base images and dependencies.
- Patch SLO: critical within 7 days, high within 30 days, medium within 90 days, subject to operational risk.
- Annual third-party penetration test (target — see Risks).
- Coordinated vulnerability disclosure programme at security@burdenoff.com.
11. Backup and disaster recovery
| Item | Detail |
|---|---|
| Database backups | Automated, encrypted; hot tier rolling 30 days |
| Long-term backups | Cold tier up to 90 days |
| BCP / DR test | At least annually |
| Default RPO / RTO | RPO 24 hours / RTO 24 hours |
| Enterprise commitment | RPO 1 hour / RTO 8 hours (subject to deployment mode) |
12. Incident response
- Documented IR playbooks with severity classification (SEV-1 to SEV-4).
- On-call rotation.
- Customer notification within 72 hours of confirmed Personal Data Breach.
- Post-incident review and root-cause analysis shared with affected Customers under NDA.
13. Compliance and certifications
| Item | Status |
|---|---|
| ISO 27001 | Not held |
| SOC 2 Type II | Not held |
| GDPR / DPDP Act readiness | DPA available |
| PCI-DSS | Out of scope (payment processing and marketplace payouts delegated to Stripe / Razorpay) |
| HIPAA / BAA | Not supported by default; case-by-case Enterprise review |
| Marketing-AI (EU AI Act, EU AI Act high-risk) | Customer (deployer) carries bias-audit and contact-notice obligations; HeadshotMarketing provides reasonable feature information |
| CERT-In directives (CERT-In 2022) | HeadshotMarketing complies with applicable Indian CERT-In reporting requirements (see HM-LEGAL-004A) |
14. Subprocessors
See HM-LEGAL-003C — DPA Annex 3 (Subprocessors). The live, authoritative list is published at https://headshotmarketing.com/subprocessors.
15. Customer responsibilities (shared responsibility)
| HeadshotMarketing | Customer |
|---|---|
| Service infrastructure and platform | Lawful basis, consents and notices for marketing data |
| Service-level RBAC primitives | Customer's RBAC / SSO configuration and access reviews (esp. contact/CRM/engagement data) |
| Encryption of Customer Data at rest/in transit in the Service | Encryption / control of Customer Data outside the Service (exports, downloaded reports) |
| Tenant isolation in multi-tenant SaaS | Workspace-level access management within the tenant |
| AI-assist feature operation | Human-in-the-loop review of AI-assisted decisions; deployer consent / anti-spam / AI-disclosure duties |
| Backups of Service data | Independent records of contact and consent marketing-consent data |
| Relaying campaigns/messages to enabled providers | Choice of delivery provider; lawful basis and consent for sending |
16. Reporting
- Status page (group-wide): https://status.burdenoff.com — publishes status for all Burdenoff Group products including HeadshotMarketing
- Security contact: security@burdenoff.com (Burdenoff Group security mailbox; monitored by the Burdenoff Consultancy security personnel that operate the Service on HeadshotMarketing's behalf)
- Vulnerability disclosure: same address; PGP key on request
- DPO / Grievance Officer (DPDP Act): Vignesh T.V., Founder, CEO & CTO of HeadshotMarketing — contact@headshotmarketing.com
17. Changes
This Security Exhibit may be updated provided the overall level of security is not materially diminished. Material changes will be notified through standard channels.
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (HM-LEGAL-### or HM-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.