Trust Centre

On an engagement, access to your systems and data is agreed in writing before work starts: who on our team has it, what it covers, and when it ends.

Who secures what - your cloud provider, us, and your own team - is written down too, including who fixes findings and who rotates keys.

This website runs no analytics or tracking scripts and sets no cookies of its own. Fonts and media are self-hosted. The forms use Cloudflare Turnstile to keep out spam, and that check is the only third-party script on the site. The only personal data the site collects is what you send through its forms, and the Privacy Policy explains how that is used, kept and deleted.

Client data stays where you keep it. By default we work inside your own cloud accounts and data centres, under access you grant and can revoke. We do not copy client data into our own systems unless the engagement requires it and you approve it in writing, and where it does, the storage location is set out in the contract.

nSecureBackup™ Vault installs on your own infrastructure and runs air-gapped, so backup data does not leave your site.

We work with clients in India, the United States, the United Kingdom, Australia and Fiji. Where a regime applies to your data - the UK GDPR, the Australian Privacy Principles, US state privacy laws or India’s DPDP Act - the data processing agreement for your engagement records how it is met.

Access to client systems is named, least-privilege and time-bound, and is removed when the work ends. Company systems require multi-factor authentication.

Every engineer is bound by confidentiality obligations in their employment terms, and we sign your NDA before any data is shared.

Delivery does not depend on one office or one person. Our engineering tooling, source control and delivery records run on managed cloud services with their own redundancy and backups, and every engagement has a named secondary engineer who knows the system.

For systems we operate under Managed SRE, runbooks, escalation paths and recovery procedures are written down and shared with you, so recovery never depends on someone’s memory. Business continuity is reviewed as part of the management review in our ISO 9001 quality management system.

If we confirm a security incident affecting your data or a system we handle for you, we notify your named contact without undue delay and no later than 72 hours after confirmation: what happened, what is affected, what we have done and what you need to do.

A written incident report follows within five working days. Where Indian law requires it, we also report to CERT-In within six hours of becoming aware of a reportable incident, and we support you with any notification you owe your own regulators.