Skip to content
Contact Us
Flagship · GovTech
India Post — grievance system

Pan-India, awarded via GeM (Nov 2025).

Read →
Flagship · GovTech
India Post — grievance system

Pan-India, awarded via GeM (Nov 2025).

Read →
Global delivery
India · Belgium · UK

Three offices, three time zones.

→

Penetration testing and VAPT for web, mobile, API and network.

Mindrops runs vulnerability assessment and penetration testing across web, mobile, API and network — combining manual testing with automation, with clear remediation guidance and a retest.

Clients

  • Cushman & Wakefield
  • Pacific Group
  • DLF Group
  • Barbeque Nation
  • The Coffee Bean & Tea Leaf

Selected projects

A selection of the software Mindrops has designed and engineered for clients.

Quick Commerce · Logistics

RocketZone — Rider Delivery App

A custom Android rider app with real-time order assignment, Google Maps navigation, COD collection tracking, returns and exchange pickups, and delivery proof.

Designed, built, tested and deployed between January and June 2026.

Total post offices1,65,000The largest postal network in the world

Government · GovTech

India Post — Grievance Redressal

An AI-automated platform on Mindrops’ LazyMonkey foundation that categorises, prioritises, routes and auto-responds to every grievance, with one SLA-tracked record for central and regional teams.

Awarded via GeM (Nov 2025), it auto-triages thousands of grievances a day for a network of 1.5 lakh+ post offices.

Cafés in India50+outlets across India, served by the systems we builtBrewing since 1963

AI · Food & Beverage

BeanBot — The Coffee Bean & Tea Leaf

An embeddable AI chat assistant grounded in live catalogue and store data, with an “Order Now” action on every product and a no-code admin console for content and pricing.

Live across 50+ outlets in India, handling about 10,000 conversations a month and around 50 orders a day.

Penetration testing services

Mindrops runs penetration testing and VAPT across web, mobile, API and network — combining manual and automated testing, aligned to OWASP, to find exploitable weaknesses in applications, APIs, networks and devices. Each engagement delivers prioritised remediation guidance and a retest.

Web app testing

Manual and automated testing against OWASP Top 10 and business-logic flaws.

Mobile testing

iOS and Android app testing — storage, transport, auth and API security.

API testing

REST and GraphQL API testing for auth, access-control and injection flaws.

Network & infra

External and internal network and infrastructure penetration testing.

Remediation guidance

Prioritised, practical fixes for each finding.

Report & retest

Clear reporting for stakeholders and auditors, plus a retest to confirm fixes.

When to commission a penetration test

Before a launch or major release

Product teams that want exploitable weaknesses found and fixed before real users — and real attackers — arrive.

Customer and audit requests

Organisations asked by enterprise customers, regulators or auditors for an independent penetration-test report.

After significant change

Platforms that have added APIs, integrations, cloud infrastructure or authentication flows since they were last tested.

Apps handling sensitive data

Web and mobile applications processing payments, personal data or government records, where a breach carries legal and reputational cost.

Why Mindrops for penetration testing

Manual testing after automated scans
Automated tools cover breadth; our testers then chase business-logic flaws, broken access control and chained exploits that scanners miss.
Findings developers can act on
Each finding comes with reproduction steps, impact and a specific fix, written for the engineers who will apply it.
Retest built into the plan
A retest is part of the engagement, so the final report shows which issues are confirmed closed.
Explicit, comparable coverage
Testing maps to the OWASP Top 10, OWASP MASVS for mobile and the OWASP API Security Top 10, so what was covered is clear.
Technologies we use
Standards
OWASP · OWASP MASVS · NIST
Scope
Web · Mobile · API · Network
Approach
Manual + automated · Remediation · Retest

Client reviews

Extra capacity for software and cloud

A Mindrops team working alongside the client’s own engineers on software development and cloud-based projects, brought in to add reliable delivery capacity.

From the client’s review

“Mindrops handled complex requirements with ease and added value throughout the project.”
Harsh BihaniHead of Technology, Qzaark IndiaRead full review on Sortlist

Recruitment & candidate management

A recruitment platform with candidate registration, applications, admit cards and a central admin dashboard.

From the client’s review

“They designed it to handle high concurrent traffic during active recruitment drives, which was critical for us.”
AnujDirector, NIA Aviation Services Pvt. Ltd.Read full review on GoodFirms

Recruitment site maintenance

An annual maintenance contract to stabilise an aviation recruitment website and fix its online application workflow, which has to hold up during active hiring drives.

From the client’s review

“Most aviation candidates apply through phones, and the fixes to the application flow reflected a practical understanding of that, not just surface-level design changes.”
SuryaDirector, Bhartiya Aviation ServicesRead full review on Sortlist

Warehouse operations platform

A field app and web admin panel connecting material records, site expenses and reporting across warehouse locations.

From the client’s review

“Reporting that used to take a full day of compiling sheets is now a filtered download from the admin panel.”
Amit AgarwalDirector, Footprint WarehousingRead full review on Clutch

Fintech lending platform

A customer app, vendor app and admin panel from one team, with KYC, CIBIL credit checks and automated loan approvals.

From the client’s review

“Fintech projects have a lot of layers and it was good to work with a team that understood the credit and lending side of things.”
Shyam AryaDirector, Insto Fin Private LimitedRead full review on Sortlist

Rural telehealth platform

A mobile app, website and admin dashboard connecting patients in rural and semi-urban India with doctors, with video consultations, digital prescriptions and patient registration.

From the client’s review

“The UI/UX design process was collaborative and they kept the end user in mind throughout, which mattered a lot for a platform targeting rural users.”
Rama RamanDirector, EonMedRead full review on Sortlist

More client reviews

How a VAPT engagement runs

  1. 01 — Scope

    Scope and rules of engagement

    Agree targets, test type (black, grey or white box), environments, testing windows and points of contact.

  2. 02 — Test

    Assessment and exploitation

    Run automated scanning, then manual testing to confirm, exploit and chain vulnerabilities safely.

  3. 03 — Report

    Risk-ranked report

    Deliver an executive summary and technical findings rated by severity, with evidence and remediation steps.

  4. 04 — Retest

    Fix and verify

    Support your team through remediation, then retest and issue an updated report showing closed findings.

Frequently asked questions

What is the difference between VA and PT?
Vulnerability assessment finds and ranks weaknesses broadly; penetration testing actively exploits them to show real risk. VAPT combines both.
What can Mindrops test?
Web and mobile apps, REST/GraphQL APIs, and external/internal networks and infrastructure.
Does Mindrops help fix what it finds?
Yes. Mindrops delivers prioritised remediation guidance and retests after fixes to confirm the issues are closed.
Will it disrupt production?
Mindrops scopes and schedules testing to avoid disruption, and can test staging environments where appropriate.
Does a VAPT report help with compliance?
Yes. The report and retest give auditors and enterprise customers documented evidence of testing and remediation. For the wider control framework, see governance, risk & compliance.

Related insights

Contact us

Tell us what you want tested — web, mobile, API or network — and any deadline driving it. We will reply within one business day to scope the engagement.

Book a security review

An engineer will respond within one business day.

Have a defined scope? Get a quote

We use essential cookies to run this site. Analytics and marketing cookies are optional.