How we think about security
Four commitments that shape how we build, ship, and operate. They show up in our architecture, our policies, and how our team works day to day.
Secure by default.
Every design decision starts from the conservative position. Least-privilege access, encryption at rest and in transit, tenant isolation, and ephemeral storage are defaults, not toggles you have to opt into.
Built for high-stakes environments.
Multiple deployment models for different security needs: managed SaaS, single-tenant on-premises, or fully air-gapped with zero external network dependency. We've run all three in production for banks, government, and critical public infrastructure.
Your data stays yours.
Customer Managed Keys for Enterprise ensure that even we cannot see your data at rest. We don't share data across tenants. We don't move it across borders unless you ask us to. Custom models trained on a customer's data remain inside the customer's environment, with weights they own and we never reuse.
Honest about where we are.
We're ISO 27001:2022 certified and hold SOC 2 Type II. ISO 42001 is in progress, and we'll publish it when it's done. We won't claim a control we don't run.
Compliance
Independent audits are how we hold ourselves accountable. The frameworks below cover information security, AI management, financial regulation, and India's data protection law.
ISO 27001:2022
Information Security Management System. Audited annually by an accredited third party.
CertifiedSOC 2 Type I
Trust Services Criteria covering Security, Availability, and Confidentiality.
Report availableSOC 2 Type II
Operating effectiveness of controls across an audit window. Certified.
CertifiedISO 42001
AI Management System. Scoped and underway as part of our security roadmap.
In progressIndia DPDP Act
Digital Personal Data Protection Act, 2023. Our processes are built around consent, purpose limitation, and data principal rights.
In progressRBI FREE-AI
The Reserve Bank of India's Framework for Responsible and Ethical AI in the BFSI sector.
AlignedMeitY Guidelines
Ministry of Electronics and IT cloud and AI security guidelines, applied across our UIDAI, NPCI, and IndiaAI deployments.
AlignedCERT-In
Indian Computer Emergency Response Team directives for incident logging, retention, and reporting.
In touchResources
The documentation behind our practices. Most reports are released under a mutual NDA. Our security team responds within two business days.
Controls
A summary view of the technical and organisational controls we operate every day, across security, privacy, and AI safety.
Access Security
- SSO and MFA enforced for all production access
- Role-based access control with least-privilege defaults
- Unique user IDs and password hashing with salt
- Idle session timeout and a documented joiner, mover, leaver workflow
- Quarterly user access reviews
Network Security
- Azure Firewall Manager (Premium) with IDPS
- WAF, IP allowlisting, and port restrictions
- mTLS at integration boundaries; OAuth 2.0 and JWT
- VNet segmentation between environments
Data Protection
- AES-256 at rest, TLS 1.2 or higher in transit
- CMEK and BYOK with configurable rotation
- India-only residency for Indian deployments
- Configurable retention with certified deletion at termination
- PII masking, pseudonymisation, and redaction
Incident Response
- Documented Incident Management Policy within the ISMS
- Detection via Azure Monitor and Grafana dashboards
- Customer notification within two hours of discovery
- L1, L2, L3 triage with a mandatory lessons-learned retro
Change Management
- Documented change policy with required PR review
- Segregated development, staging, and production environments
- Zero-downtime deploys; phased rollouts behind feature flags
- Production data is never used in non-production environments
Vulnerability Management
- Continuous code scanning in private repositories
- Annual third-party penetration testing
- Secure SDLC with security gates prior to production
- High and critical findings closed before promotion
Availability and Recovery
- 99.9% uptime SLA on enterprise contracts
- Daily encrypted backups with real-time replication for critical data
- Multi-AZ and multi-DC redundancy and failover
- BCP and DR plan tested against agreed RPO and RTO targets
People and Organisation
- Background verification through SpringVerify for every hire
- NDAs and confidentiality agreements at onboarding
- Security and privacy training at hire, with annual refreshers
- Dedicated InfoSec function with executive sponsorship
AI and Model Security
- Inference-time guardrails against prompt injection
- Input and output sanitisation with sensitive-content filtering
- Versioned models, prompts, and evaluations with audit trail
- Customer data is never used to train models for other customers
Frequently asked questions
AI agents that understand, learn, and always deliver.
AI agents that understand,
learn, and always deliver.