Security and Compliance
Code ownership, IP transfer, NDAs, and security review are built into every engagement. We operate within your security perimeter, never use your data to train models, and transfer full IP ownership as standard.
100%
IP transfer on every engagement
24hr
NDA execution time
5 days
Vendor onboarding completion
What we commit to
Seven pillars of trust
SOC2 Compliance
- SOC2 Type I audit currently in progress across security, availability, and confidentiality trust service criteria
- Controls cover: access management, encryption at rest and in transit, incident response, vendor risk, change management, and employee security training
- SOC2 report shared with prospective clients under NDA once audit is complete
Data Handling Policy
- Client data is never used to train third-party models
- We operate within your cloud environment and security perimeter
- PII detection and redaction before any LLM processing
- Data retention policies agreed per engagement and enforced automatically
IP and Code Ownership
- Full IP transfer on every engagement. Code is yours from day one.
- No license lock-in, no vendor dependency, no proprietary frameworks
- Open-source tools and standard infrastructure so your team owns everything
- IP assignment clauses standard in our contracts
NDA Standards
- Mutual NDAs signed before first technical conversation
- Covers: project details, architecture, business strategy, client data, proprietary processes
- Client-provided NDAs accommodated. Execution within 24 hours.
GDPR Readiness
- Systems comply with GDPR for clients with EU operations or customers
- Consent management, DSAR handling, right to erasure, data minimisation
- Privacy-by-design architecture on all new builds
Penetration Testing
- Security reviews on all production deployments
- Third-party pen testing supported with remediation within agreed SLAs
- OWASP Top 10, dependency scanning in CI/CD, prompt injection testing
Health Data and PHI
- Deployment runs inside your existing HIPAA-approved environment: your Azure tenancy, AWS account or GCP project. No PHI is processed outside infrastructure you have already approved.
- No production patient data in development or testing. Anonymised or synthetic data throughout.
- PII and PHI redacted before any LLM processing. Deployment architecture documentation available for your security and compliance review before an engagement starts.
- We never build systems that make autonomous clinical treatment, diagnosis or prescribing decisions.
- Business Associate Agreement: tell us what your counsel requires and you get a direct answer, confirmed in writing before contract signature.
Vendor Onboarding
- Pre-filled security questionnaires, architecture diagrams, AI risk registers
- Data flow documentation, insurance certificate confirmed before signature, team background verification
- Member of the Microsoft AI Cloud Partner Program, Partner ID 7158199
- Average vendor onboarding: 5 business days
SOC2
Type I In Progress
Security, Availability, Confidentiality
24hr
NDA Execution
Signed before first technical conversation
5 days
Vendor Onboarding
Security questionnaire to approval
Pre-filled Vendor Security Questionnaire
Save your procurement team hours. Download our pre-filled security questionnaire covering infrastructure, data handling, access controls, incident response, and compliance posture.
Download PDFNeed more detail?
Request our full security deck, architecture documentation, or schedule a call with our engineering team to discuss your specific compliance requirements.
FAQs
Security and procurement questions
Not yet. A SOC 2 Type I audit is in progress across the security, availability, and confidentiality trust service criteria. The report is shared with prospective clients under NDA once the audit is complete.
You do. Every engagement includes full IP transfer, and the code is yours from day one. IP assignment clauses are standard in our contracts, and we use open-source tools and standard infrastructure so there is no license lock-in.
Yes. Mutual NDAs are signed before the first technical conversation. If you have your own NDA, we accommodate it and execute within 24 hours.
No. Client data is never used to train third-party models. We operate within your cloud environment and security perimeter, and PII is detected and redacted before any LLM processing. Retention is agreed per engagement.
Security reviews are run on all production deployments. They cover the OWASP Top 10, dependency scanning in CI/CD, and prompt injection testing. Third-party penetration testing is supported, with remediation within agreed SLAs.
Deployment runs inside your existing HIPAA-approved environment, so no PHI is processed outside infrastructure you have already approved. Development and testing use anonymised or synthetic data. For a Business Associate Agreement, tell us what your counsel requires and you get a direct answer in writing before contract signature.
Average vendor onboarding is 5 business days. We provide a pre-filled security questionnaire, architecture diagrams, AI risk registers, and data flow documentation, and the questionnaire is available to download from this page.
The team is based in India, with headquarters in Mohali, Punjab. We have no offices outside India. Clients are across the United States, Australia, and the UAE.
