Security, data protection and DPDP Act compliance: How we look after your systems and your data.
India's cyber security agency, CERT-In, handled more than 29.44 lakh cyber incidents in 2025 (PIB, January 2026). Before you let a supplier near your systems, you should know how it works. These are the practices we follow on every project, published so you can see them before you ask.
- Free 30-minute call
- Fixed quote in writing
- Code you own
Six areas, written down.
A security question about your project? Ask an engineer.
Thirty minutes with a senior engineer, free and with no obligation. Bring the problem, not a brief.
Sending us a security questionnaire?
Good. We complete supplier security questionnaires honestly and in writing, and we can provide our Data Processing Addendum, a list of the sub-processors your project would use, showing where each one processes data, and a description of the practices on this page.
If your own customers send you questionnaires, or you are working towards ISO 27001, a security audit by a CERT-In empanelled auditor, or the cyber security rules your regulator sets, we build and document your systems to support that work. The certificate or audit report is yours to obtain from the relevant body.
Frequently asked questions.
Will you complete our supplier security questionnaire?
Yes. Send it through the contact form or ask on a call, and we will complete it honestly and in writing. Where a question does not apply, or a control is handled by a hosting provider rather than by us, we say so and explain who is responsible.
Where is our data hosted?
Where you need it to be. When data must stay in India, we host on AWS (Mumbai or Hyderabad), Microsoft Azure (Pune, Chennai or Mumbai) or Google Cloud (Mumbai or Delhi). Any provider that processes data outside India, such as an AI model provider, is named in your sub-processor list, so nothing is hidden.
Do you sign a Data Processing Addendum and an NDA?
Yes. Our Data Processing Addendum sets out how we handle personal data on your behalf, as the DPDP Act expects of a business and the processor it uses. It comes with every statement of work that involves personal data. We sign a mutual NDA before any detailed discussion where you need one. Both are ready before work starts.
Do you use AI tools on our code or data?
We use AI tools for parts of our engineering work, under the same confidentiality rules as everything else, and our engineers review what they produce. If you would prefer some code or data never to be processed by AI tools, tell us and we will agree that in writing.
What happens to our data when the project ends?
We return or delete it, as you choose, unless the law requires us to keep it, and we confirm deletion in writing if you ask. Access to your systems is removed at the same time, and your accounts and credentials stay with you.
Which Indian rules do you build for?
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, which start in phases. Until the main duties begin, section 43A of the IT Act, 2000 and the SPDI Rules, 2011 apply. We also build for the CERT-In Directions of 28 April 2022: report incidents within 6 hours and keep logs for 180 days in India.
Can you help us meet our own security obligations?
Yes. We build systems with access control, logging, backups and documentation that support ISO 27001, CERT-In's reporting and log rules, the DPDP Act and your customers' requirements. Certificates and audits come from the relevant body, so we never claim to make you certified or compliant. Take advice from your lawyer on your own duties.
Still have a question? Call +91 99966 88404 and speak to an engineer.