Answers for your security review
Our tools run inside your environment: on your machines, in a cloud account in your name, or on hardware you own. By default we never hold your data. This page covers what that means in practice, what we can send your reviewers today, and what we don't have yet.
Request the security packWhere your data lives
On machines you own. Nothing leaves your network; we connect only with your permission, for support.
In a cloud account in your name, including India-hosted providers. Data stays in the region you choose.
On a machine you buy through a hardware partner. You own it; the warranty sits with the manufacturer.
Every tool can run in sealed mode, where it refuses any outbound connection other than to the model you've approved. We test that on every release.
What we can send your reviewers today
An architecture and data-flow diagram for each tool
A threat model
A completed security questionnaire in the CAIQ style
Our security, incident response, access control and data retention policies
A data processing agreement, with Standard Contractual Clauses for EU clients
A business associate agreement for US healthcare work
A list of sub-processors
A model inventory with licences
A sample test report
What we don't have yet
SOC 2: not yet. We'll begin a Type I audit when a client engagement needs one. Until then, pilots run inside your certified environment, so your existing controls cover the data.
ISO 27001: not yet.
Penetration tests: commissioned for a pilot on request, and quoted separately.
Laws we design for
- India's DPDP Act 2023 and DPDP Rules 2025, with full obligations from 13 May 2027TCSA, DPDP Rules 2025: implementation roadmap, 2026-03-11
- RBI's Digital Lending Directions 2025 and the FREE-AI framework (August 2025)The Legal 500, The RBI's Digital Lending Directions, 2025, 2025-08-21; Scrut, Exploring RBI's FREE-AI, 2025-09-23
- CERT-In's directions, including six-hour incident reportingCERT-In, Directions under section 70B(6) of the Information Technology Act, 2022-04-28
- HIPAA, through business associate agreementsHHS, Business associate contracts, 2013-01-25
- GDPR, through a data processing agreement and Standard Contractual Clauses (India has no EU adequacy decision)European Commission, Standard contractual clauses for international transfers, 2021-06-04; European Commission, Adequacy decisions, 2026
- The EU AI Act, whose high-risk obligations for areas such as recruitment and credit apply from 2 December 2027DLA Piper, The Digital AI Omnibus: proposed deferral of high-risk AI obligations, 2026-06-30
- DORA, for EU financial-sector clientsEUR-Lex, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), 2022-12-14
Who processes data for this website
This covers the website, bookings and audits bought online, not client work.
- Hosting: Vercel
- Scheduling: clndr.pro, our own product
- Email: Amazon SES
- Database: Neon, for audit orders, intake forms and sample requests
- Payments: devsforfun ID, our own platform, which uses Razorpay
How we test
Every number on this site comes from a stored test run. Under Run and improve, every model update is tested on your own examples before it reaches your staff.
See the evidence