Our security, privacy and compliance posture for enterprise AI and operational systems, stated plainly with controls and audit provisions.
Certification and assurance evidence
Enterprise due diligence should identify the legal entity, the scope being assessed and the evidence relevant to the proposed engagement. A platform provider’s certificate and a delivery company’s certificate are different documents. Neither should be presented as proof for an entity or activity outside its stated scope.
For a certification review, request the standard and version, certified legal entity, issuing certification body, certificate reference, covered scope and validity dates. The complete document and its verification route matter more than an isolated badge. ISO develops standards; certification is performed by certification bodies.
Review the controls for your engagement
The project design should explain where information is processed, which people and services can access it, what is retained and how access is removed. These details depend on the selected applications, integrations and operating arrangements. A general cloud region statement does not establish the location of every connected component.
For AI enabled work, review approved sources, model and service providers, output evaluation and the actions that require human approval. Define how an incorrect answer or failed action is handled. The relevant evidence is the agreed design and its validation, not a claim that every AI output is accurate.
Request an enterprise assurance review
Tell us which entity, service and control questions your procurement or security team needs to assess. We can discuss the appropriate evidence and contractual scope for that review. Please do not send confidential system records or credentials through the website enquiry form.
Request enterprise assurance informationData residency
We deploy in Indian regions by default for Indian clients, and inside your own cloud tenant where that’s your requirement.
Available regions: AWS Mumbai (ap-south-1) and Hyderabad (ap-south-2) · Azure Central India (Pune), South India (Chennai), West India (Mumbai) · Google Cloud Mumbai (asia-south1) and Delhi NCR (asia-south2) · Zoho India data centres (Mumbai and Chennai).
Model inference: Regional endpoints where the provider offers them, documented per deployment before build. Where a model provider has no Indian endpoint, we tell you before you commit.
Access control and data handling
Our AI governance
The controls we apply to every agent we build, unless you explicitly ask for something different in writing:
Working with your auditors
Right to audit
Included in our contracts for you and, where applicable, your regulator, including on site.
Subcontractors
Disclosed in a register, with prior consent required for any change affecting your data. Cloud and model providers named explicitly.
Incident response
We notify you without undue delay, support your investigation with logs and forensics, and equip you to report to your regulator, CERT-In or the Data Protection Board.
Exit
Documented exit and data portability plan from the start of the engagement, not negotiated at the end. You get your data, your configuration, your code and your documentation.
Privacy
We operate as a Data Processor under India’s DPDP Act 2023 and DPDP Rules 2025, bound by a processing agreement covering security safeguards, breach notification support, retention, deletion and consent artefact handling. Fiduciary obligations remain yours; the discipline that lets you meet them has to be ours.
BFSI compliance detail