Dhur Health Camp
Dhur Health Camp — Patient Management System
A lightweight platform connecting doctors, BHU workers, camp assistants, and families around a single patient record — enabling continuity of care for nomadic communities.
Selected work, on the ground in Bhutan.
Bridges we've built — from hydropower control rooms to public-sector field tools, or just a tool to get help that is available to the people it is ment for.
Children's Home Asia
Children's Home Asia — Donation Platform
A secure, bilingual (German/English), password-protected donation platform presenting individual child profiles to a trusted community of sponsors — with transparent monthly targets and fee-free bank transfers.
More case studies are on the way. Tell us about your project.
Security
Security matters to us.
This section describes the encryption methods we use for our websites, our project tooling, and for the file and video hand-offs we send to clients. It's not an independent certification — just an honest description of the technical controls in place.
Transport — websites
All our domains and subdomains are served exclusively over HTTPS. Traffic is protected with TLS 1.3 and authenticated AEAD ciphers (TLS_AES_256_GCM_SHA384, with TLS_AES_128_GCM_SHA256 as a fallback). Certificates are issued by publicly trusted authorities and renewed automatically. Plaintext HTTP is not accepted.
File & video hand-offs
Larger deliveries — demo recordings, drone footage, technical documentation — run through a European cloud storage service in ISO 27001-certified data centers. Every share link is delivered over TLS 1.3 with AES-256-GCM; the provider operates under GDPR.
For sensitive material we additionally enable the storage service's client-side end-to-end encryption. Files, file names, and directory names are encrypted on the device itself, using a hierarchical key scheme:
- File contents: AES-256 in authenticated mode, a unique key per file.
- File keys are wrapped by a directory key, which is in turn wrapped by the passphrase-derived user key.
- Shares use a dedicated share key — recipients never receive keys for unrelated files.
- Key wrapping via RSA-2048/4096; passphrase-derived keys via PBKDF2 with a per-user salt.
- Share links can additionally be protected with a password and expiry date — both are the default for confidential material.
Project & collaboration tooling
For tasks, briefs, and client collaboration we use a SOC 2-audited SaaS platform. All traffic between our devices and the platform is protected with TLS 1.3 (AES-GCM). Data at rest is encrypted with AES-256; access is scoped per workspace and per user through role-based permissions and mandatory authentication.
Standards at a glance
- Transport: TLS 1.3, AES-GCM AEAD, forward secrecy via ECDHE.
- File contents / end-to-end: AES-256 authenticated.
- Key exchange & wrapping: ECDHE, RSA-2048/4096.
- Password-derived keys: PBKDF2 with a per-user salt.
- Certificates: publicly trusted CAs, automatic renewal, HTTPS only.
We operate on a shared-responsibility model: our hosting, storage, and collaboration providers supply the underlying infrastructure and cryptographic building blocks; Zampa Technology Solutions owns configuration, uploaded content, and per-project access rights. Project-specific requirements — data residency, retention periods, additional controls — please raise at kickoff so we can reflect them in the project setup. Security contact: contact@zampatech.com.