How does WinCore protect data in transit and at rest?

Public routes use HTTPS with HSTS and a host-based Content Security Policy. The CSP restricts external script sources but permits inline scripts for prerendered Next.js pages; it does not use per-request nonces. Framing is denied by default, with configured exceptions for embeddable tools. Sensitive payloads are encrypted at rest and routed through signed storage buckets with scoped credentials.

What is WinCore's incident response timeline?

Security events are acknowledged within one business hour during staffed coverage, containment starts the same business day for material incidents, and client stakeholders receive a documented update within 24 hours once the initial facts are confirmed. Every case ends with a post-incident review and corrective actions.

Which audits, certifications, or control reviews does WinCore maintain?

We run quarterly third-party vulnerability scans, annual policy reviews, and control checks against ISO 27001 and SOC 2 expectations. ISO 27001 Information Security Management certification work is in progress, and SOC 2 Type II is targeted for Q2 2027, so prospects can see the roadmap and current assurance cadence side by side.

How is access to client systems controlled?

Access is provisioned on a least-privilege basis with role-based controls, scoped credentials, and approval workflows. Elevated access is time-bound, reviewed during delivery governance checks, and removed when the task is complete.

Where is business data handled for Sri Lanka engagements?

Data handling follows contractual data-location and transfer requirements. For Sri Lanka-focused workloads, operational processing and support are coordinated through Colombo delivery teams with documented retention controls.

Security & Compliance

Your finance data is handled with the same controls your board expects internally

Every engagement runs on HTTPS-enforced routes, a host-based Content Security Policy, least-privilege access, and signed storage buckets. The CSP permits inline scripts for prerendered pages and does not use per-request nonces. ISO 27001 certification work is in progress.

Last updated: 30 September 2026

Request your controls briefing pack security@wincore.lk

Hardened Edge Controls

Security headers include Strict-Transport-Security, a host-based CSP, and Permissions-Policy. Framing is denied by default, with configured exceptions for embeddable tools. Inline scripts are permitted for prerendered Next.js pages.

Threat Detection & Rate Limiting

Middleware inspects every header and payload for injection patterns, applies behaviour-based throttling, and blocks flagged actors before a single line of application code executes.

Consent & Privacy Governance

Signed consent cookies, purpose-scoped analytics opt-ins, and documented retention schedules keep your engagement aligned with Sri Lanka's PDPA, GDPR-style obligations, and contractual data-location terms.

Operational Assurance

Every pod starts with a signed DPA, role-based access provisioning, time-bound elevated credentials, and audit-ready change logs. Reviewed at each delivery governance checkpoint.

Give your procurement team the evidence they need

Security responsibilities are documented before day one - mapped to ISO 27001-informed controls, SOC 2 expectations, and GDPR-style governance. Your procurement lead gets a clear view of risk ownership, not a verbal assurance.

Signed DPAs and confidentiality agreements for every analyst (provided at engagement sign-off).
Secure credential vaults and least-privilege access to client systems.
Quarterly third-party vulnerability scans with remediation tracking (summary reports shared under NDA during due diligence).

Certification Roadmap

ISO 27001 Information Security ManagementIn progress
SOC 2 Type II AuditTarget: Q2 2027
Cyber Liability Insurance coverageActive

Controls audited quarterly. A current controls summary is shared with clients and prospects during due diligence. contact the security desk to request yours.

Security contacts

Primary contact: security@wincore.lk
Emergency hotline: +94 77 747 0904
Office: 411/5, Havelock Road
Colombo 06, Sri Lanka. 00500

What your controls briefing pack includes

Delivered during a live session arranged through our security desk. Shared under NDA, not available as public downloads.

Stack overview (Next.js 15, middleware enforcement, structured data governance)

Edge security controls and incident response workflow

Data classification, retention, and destruction policies

Third-party tooling map with risk assessments

Request your security briefing pack

Controls summary, incident response workflow, and DPA templates - shared under NDA within one business day.

Responsible disclosure

If you believe you have found a security vulnerability in a WinCore website or service, please tell us privately so we can investigate and fix it.

How to report

Email security@wincore.lk with “Security vulnerability report” in the subject line.

What to include

The affected URL, page, or service
A description of the issue and its likely impact
Steps to reproduce it, with screenshots if helpful
How we can contact you for follow-up questions

What we ask of you

Do not access, change, or delete data that does not belong to you
Do not disrupt our services or other users while testing
Do not disclose the issue publicly until we have had a reasonable chance to fix it

We will acknowledge your report and keep you informed as we investigate. This policy does not offer payment for reports.

Frequently Asked Questions

How does WinCore protect data in transit and at rest?: Public routes use HTTPS with HSTS and a host-based Content Security Policy. The CSP restricts external script sources but permits inline scripts for prerendered Next.js pages; it does not use per-request nonces. Framing is denied by default, with configured exceptions for embeddable tools. Sensitive payloads are encrypted at rest and routed through signed storage buckets with scoped credentials.
What is WinCore's incident response timeline?: Security events are acknowledged within one business hour during staffed coverage, containment starts the same business day for material incidents, and client stakeholders receive a documented update within 24 hours once the initial facts are confirmed. Every case ends with a post-incident review and corrective actions.
Which audits, certifications, or control reviews does WinCore maintain?: We run quarterly third-party vulnerability scans, annual policy reviews, and control checks against ISO 27001 and SOC 2 expectations. ISO 27001 Information Security Management certification work is in progress, and SOC 2 Type II is targeted for Q2 2027, so prospects can see the roadmap and current assurance cadence side by side.
How is access to client systems controlled?: Access is provisioned on a least-privilege basis with role-based controls, scoped credentials, and approval workflows. Elevated access is time-bound, reviewed during delivery governance checks, and removed when the task is complete.
Where is business data handled for Sri Lanka engagements?: Data handling follows contractual data-location and transfer requirements. For Sri Lanka-focused workloads, operational processing and support are coordinated through Colombo delivery teams with documented retention controls.