Overview

24Squad hosts production infrastructure on Indian-resident servers operated by our venture WebHost24, with strict controls on data access, transport, backup, and incident response. This page documents those controls so customers, prospects, and regulators can verify them.

Hosting

Provider: WebHost24 (operated by 24Squad)
Primary locations: Palitana, Gujarat and Mumbai, Maharashtra
DNS: Anycast, with a secondary provider for failover
TLS: Free SSL via Let’s Encrypt, renewed automatically
Backups: Daily snapshots retained for 30 days; weekly snapshots retained for 12 weeks

Data protection

TLS 1.2+ on all public traffic. TLS 1.0 and 1.1 are disabled.
HSTS preload-ready — Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
Strict CSP — Content-Security-Policy denies inline scripts without nonces and denies scripts from external origins not on the allowlist.
HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — every public page returns the full set of security headers via the Dokploy _headers.json configuration.
DPDP Act 2023 compliant — see Privacy policy for the data-handling matrix.

Backups

Daily snapshots retained for 30 days.
Weekly snapshots retained for 12 weeks.
Backups are encrypted at rest (AES-256).
Backups are stored in a separate physical location from the primary database.
Restore drill: we test a full restore from the latest backup monthly.

Access control

All production access is via short-lived SSH keys issued through the team password manager.
Two-factor authentication is required for every production tool (hosting panel, DNS, CI/CD, code repository).
The founder + 24Squad security office are the only parties with root access. No third-party contractor has standing production access.
Every production change is logged in the deployment audit trail.

Vulnerability disclosure

If you have discovered a security vulnerability in any 24Squad property, please email [email protected] with a description and a reproducer. We commit to:

Acknowledge your report within 48 hours.
Provide a triage assessment within 5 business days.
Patch confirmed critical and high-severity vulnerabilities within 30 days.
Credit you in the public disclosure if you request it (and you have given us reasonable time to patch before disclosure).

We do not pursue legal action against good-faith security research that follows this disclosure policy.

Breach disclosure

If we discover a breach affecting customer data, we will:

Notify affected customers within 72 hours of confirming the breach.
Publish a public incident report on security.webgrow24.in/status with the timeline, scope, mitigation, and remediation.
Cooperate with regulators and, where required, notify the Indian Computer Emergency Response Team (CERT-In) under the 2022 Directions.

Compliance attestations

The following controls are in place and audited annually:

TLS configuration — externally audited quarterly via Qualys SSL Labs.
Security headers — verified on every CI build via the scripts/security-headers-integration.mjs test.
Dependency vulnerabilities — npm audit --omit=dev runs on every PR; critical and high CVEs block merge.

How to verify

You can independently verify the controls above by:

Running curl -I https://www.24squad.in/ and inspecting the response headers.
Running an SSL Labs scan against www.24squad.in.
Reading the public deployment audit trail.

This page was reviewed by Renish Mithani on 19 July 2026 and is reviewed quarterly.

Security

Want to know more about 24Squad?