# Security and compliance engineering > Find the holes before someone else does, and make the code do what the policy promises. - Page: https://deependra.in/services/secure - Type: Service line 4 of 5 (Secure) - Last updated: 2026-11-02 - Author: [Deependra Vishwakarma](https://deependra.in/about), senior software engineer in Mumbai ## In short Application security services find and fix the holes in a web application and its infrastructure: authentication, access control, injection, configuration and secrets, with a fix list your team can act on. They are for SaaS, fintech and health teams facing a security questionnaire or a launch. I completed the Google Cybersecurity Specialization. I do engineering, not legal advice, and I work alongside your counsel. ## Problems this work solves 1. Your app was built fast, maybe with AI tools, and you're not sure what it exposes. 2. An enterprise customer sent a security questionnaire you can't answer yet. 3. You're about to launch and want to know what an attacker would see first. ## What are application security services? Application security services are security engineering for web applications: I test applications and their cloud infrastructure the way an attacker would, report what I find with evidence and a fix for each finding, and harden the code so it does what your security and privacy policies promise. It is for SaaS, fintech and health teams in the US, UK, EU, the Gulf, Japan and Korea. I completed the Google Cybersecurity Specialization. I do engineering, not legal advice: deciding which laws apply to your business is for your counsel, and I work alongside them. ## Who this is for, and who it isn't It suits a SaaS company facing its first enterprise security questionnaire, a product handling health or financial data, a team preparing for SOC 2 or ISO 27001 who want the technical gaps found first, and a founder whose app was built quickly, perhaps with AI tools, and now has real users. It does not replace a formal certification audit. SOC 2 and ISO 27001 need an accredited auditor; I help you get ready for one. It is also not a box-ticking scan: automated tools give breadth, and the findings that matter usually come from manual testing of access control and business logic. ## Pick your risk Pick the risk that sounds most like yours; the first sentence of each says where to start. **An app built fast, perhaps with AI tools:** start with the [security audit and penetration test](https://deependra.in/services/secure/security-audit), which checks the places such apps most often fail, from exposed secrets to missing authorization checks. The [12-point checklist for hardening an AI-built app](https://deependra.in/writing/hardening-an-ai-built-app-checklist) lists them. **An AI feature that reads documents or uses tools:** the main risk is text that steers the model. [Prompt injection in RAG and agent systems](https://deependra.in/writing/prompt-injection-rag-agents) explains the attacks and the defences that hold, and [LLM evals, guardrails and cost control](https://deependra.in/services/ai/llm-evals) puts those tests into CI. **A privacy law or an opt-out signal:** the engineering is making the backend do what the banner and the policy say. [US state privacy laws and Global Privacy Control](https://deependra.in/writing/us-state-privacy-global-privacy-control) is the guide, and your counsel decides which laws apply to you. **An accessibility law or a conformance request:** start with the [accessibility audit and remediation](https://deependra.in/services/secure/accessibility-remediation), an audit against WCAG 2.2 AA with the fixes in your code. The [European Accessibility Act guide](https://deependra.in/writing/european-accessibility-act-for-web-teams) covers whether it applies. **A general audit, a security questionnaire or a launch:** the [security audit and penetration test](https://deependra.in/services/secure/security-audit) is the usual first step, and [what a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains) shows the result. ## The problems I usually hear "A customer sent a security questionnaire and we can't answer half of it." "We launch next month and nobody has looked at this from the outside." "The app was built fast and we don't know what it exposes." "Our privacy policy says one thing and our code does another." In my experience the serious findings cluster in a few places: one user able to read another user's data, secrets committed to a repository, missing rate limits, and cloud permissions far wider than the job needs. Broken access control is the first entry in the OWASP Top 10:2025 for a reason. ## What you get You get a scoped test plan with rules of engagement agreed in writing, findings rated by severity with a proof of concept and a fix for each, an infrastructure review covering IAM, network rules, TLS, headers and secrets, a retest after your fixes, and an executive summary you can share with customers and investors. The [security audit and penetration test](https://deependra.in/services/secure/security-audit) is the live offer today. The [accessibility audit and remediation](https://deependra.in/services/secure/accessibility-remediation) applies the same audit-then-fix approach to WCAG 2.2. To see what the report itself looks like, read [what a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains), which walks through a fictional sample finding. ## How it starts With scoping: the targets, the test accounts, the time windows and what is out of bounds, agreed in writing and priced as a fixed scope. Testing runs against staging where possible; where it must touch production, we agree windows and limits in advance and destructive tests are never run there. I'll sign an NDA before seeing any detail, and findings go only to the people you name. ## Where this work happens The regime shapes what the audit pays most attention to. For [EU](https://deependra.in/markets/europe) and [UK](https://deependra.in/markets/united-kingdom) teams it is the GDPR and UK GDPR: security of processing, processor terms and the records that show personal data is protected. For [Saudi Arabia](https://deependra.in/markets/saudi-arabia) it is the Personal Data Protection Law and its rules on transfers outside the Kingdom; for the [UAE](https://deependra.in/markets/uae), the federal law or the DIFC or ADGM regime, depending on where you are established. For [Japan](https://deependra.in/markets/japan) and [South Korea](https://deependra.in/markets/south-korea) it is the APPI and PIPA, both with rules on providing personal data overseas. In every case I test the technical measures and document them; confirm which obligations apply with your counsel. ## Security and compliance engineering services - [Security audit and penetration test](https://deependra.in/services/secure/security-audit): An attacker's view of your application and infrastructure, and a fix list you can act on. (price: Fixed price per scope; timeline: Agreed per project after scoping) - [Accessibility audit and remediation](https://deependra.in/services/secure/accessibility-remediation): WCAG 2.2 AA audits and the fixes in your code, for teams under the European Accessibility Act or asked for a conformance report. (price: Fixed price for the audit, then a quote for the fixes; timeline: Audit first, then fixes in stages) ## Case studies behind this work - [Vayudoot Aviations](https://deependra.in/work/vayudoot-aviations-platform): Education platform. - [Immunomate](https://deependra.in/work/immunomate-telemedicine): Telemedicine platform. 500+ registered users. ## Questions about security and compliance engineering ### Is this legal advice? No. I implement and test the technical measures that laws and standards call for, and document them. Deciding which obligations apply to your business is for your lawyer; I work alongside them. ### Can you sign an NDA before seeing our code? Yes, before we discuss any detail. Findings are shared only with the people you name. ### What's the difference between a vulnerability scan and a penetration test? A scan runs automated checks for known issues and gives breadth. A penetration test adds manual work: chaining issues together and testing access control and business logic the way a person would. The audit uses both. ### How do you rate severity? With a standard scale such as CVSS for the technical score, adjusted for your context: what data is exposed, who can reach it and what it would cost you. The report explains the reasoning for each rating. ### Will the report help with SOC 2 or ISO 27001? It finds and fixes technical gaps before an auditor does, and the retest gives you evidence that they're closed. The certification itself needs an accredited auditor. ### Can you audit an app built with AI coding tools? Yes. Exposed secrets, missing authorization checks and permissive database rules are common in apps built quickly, and they're among the first things I test. ### Do you retest after we fix things? Yes. A retest of every finding is part of the audit, and the report is updated to show what's closed. ### Do I need a pentest or a security audit? Usually one engagement covers both. The [security audit and penetration test](https://deependra.in/services/secure/security-audit) combines automated scanning for breadth with manual penetration testing, and ends with a ranked fix list and a retest. A scan alone shows known issues; the findings that matter most usually come from manual testing of access control and business logic. ### What is different about securing an AI feature? The model can be steered by the text it reads, so a document, an email or a web page can carry instructions. Prompting alone does not fix that; the durable defences are least-privilege tools, confirmation for risky actions, instructions kept apart from data, and output checks, tested like any other change. [Prompt injection in RAG and agent systems](https://deependra.in/writing/prompt-injection-rag-agents) goes through them. ## How this works in your market ### How this works in the European Union Testing happens inside your EU infrastructure where possible, so data stays stored there. EU guidance treats remote access from India as a transfer, so the engagement includes Standard Contractual Clauses; confirm with your counsel. [European Union page](https://deependra.in/markets/europe) ### How this works in Saudi Arabia PDPL transfer rules are part of the scoping conversation, and test data stays in the Kingdom when your hosting does. [Saudi Arabia page](https://deependra.in/markets/saudi-arabia) ### How this works in the United Arab Emirates Federal, DIFC and ADGM data-protection regimes differ; the audit's privacy checks follow the one your counsel confirms applies. [United Arab Emirates page](https://deependra.in/markets/uae) ## Sources 1. [OWASP Top 10:2025](https://owasp.org/Top10/2025/) 2. [FIRST: CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) ## Related writing - [What a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains) (2 November 2026): The sections of a web application pentest report, what each one is for, and a fictional sample finding written the way I write real ones. - [Hardening an AI-built app: the 12-point checklist](https://deependra.in/writing/hardening-an-ai-built-app-checklist) (2 November 2026): The twelve checks I run first on an app built quickly with AI coding tools, in the order that finds the most serious problems soonest. - [The European Accessibility Act for web teams: what applies, and an engineering checklist](https://deependra.in/writing/european-accessibility-act-for-web-teams) (2 November 2026): What the EU accessibility law asks of a website or app since June 2025, how EN 301 549 and WCAG fit in, who is exempt, and the checklist I work through. - [US state privacy laws and Global Privacy Control: a guide for engineers](https://deependra.in/writing/us-state-privacy-global-privacy-control) (2 November 2026): Which regulators say a business must honour the GPC signal, what the Sec-GPC header means in code, and the consent and data-request plumbing around it. ## Start Start a project: https://deependra.in/contact --- Cite as: Deependra Vishwakarma, "Security and compliance engineering", https://deependra.in/services/secure (last updated 2026-11-02). This is the Markdown version of https://deependra.in/services/secure; the page is the canonical source. Start a project: https://deependra.in/contact