Security
In your tenant. In your repo. Stated plainly.
The shared core below applies to every engagement. Market-specific statements follow, and every certification is listed as held or not held, with nothing implied.
5 commitments · 4 certifications stated · 6 markets
01
The shared core
- 01Built in your tenant and your repository. No client data is copied to our systems.
- 02Acceptance is a pre-agreed eval bar and a cost ceiling, written into the contract.
- 03Prompts, evals and gateway configuration are versioned in your repo; you can change any of it without us.
- 04Secrets never leave your secret manager. Our environments use short-lived, scoped credentials.
- 05Every agent ships with a runbook, monitoring and an incident path.
02
Certifications
- Claude Partner NetworkRegistering
- Registering.
- UK Cyber EssentialsApplying
- Applying at launch.
- ISO 27001Not held
- Not held. Decision and date on this page when made.
- SOC 2 Type IINot held
- Not held. A dated plan will appear here before the first US mid-market review.
03
By market
- India
- Handling aligned with the Digital Personal Data Protection Act; obligations landing in 2027 are designed in now. GST and TDS terms fixed in every statement of work.
- United States
- CCPA-aligned handling. Delivery in your tenant answers most vendor questionnaires; a completed SIG-Lite is available on request.
- United Kingdom
- India has no UK adequacy decision, so an IDTA transfer pack is part of the contract. Delivery in your tenant means little personal data transfers at all.
- European Union
- Standard Contractual Clauses and a data processing agreement on request. High-risk AI Act obligations are designed for from the eval and documentation stage.
- Gulf
- UAE PDPL-aligned handling; Saudi PDPL through a local partner. Government work needs ISO 27001, which is stated above as not yet held.
- Singapore and Canada
- PDPA statement and IMDA agentic framework mapping, and Canadian residency written down, come with the second wave.