Security, DPDP
& AI governance.
Agentic systems touch real customer data and take real actions. We treat that as a design constraint, not a policy PDF. Here’s how we handle data, access, and oversight.
Data handling
Data you can
account for.
We act as a data processor for client data and sign a DPA before kickoff. For our own website enquiries, we are the data fiduciary.
Data map first
Before we connect anything, we document what data the workflow touches, where it lives, who can access it, and how long it is kept.
Purpose limitation
We access only what the workflow needs, for the purpose you specified. No secondary use, no advertising, no model training.
Minimisation & retention
We redact what isn’t needed, set retention windows, and delete or return working data at handover unless you ask us to keep it.
Least-privilege access
Scoped API keys, service accounts, separate staging and production, MFA on our accounts, and immediate revocation on exit.
Hosting choice
India-region hosting or your cloud account where residency matters. We document every sub-processor and transfer.
Incident response
A named contact, a written escalation path, and notification timelines in the contract. We test the rollback before go-live.
Governance
Built for the
audit conversation.
India’s regulatory direction is clear: human oversight, kill switches, audit logs, and accountability for third-party models. We design the workflow so those answers exist before procurement asks.
What we align to
DPDP.
CERT-In.
RBI/SEBI-aware.
We don’t claim certification. We design to support your compliance work and give your team the artefacts to prove it.
DPDP Act 2023 & Rules 2025
Notice, consent, purpose limitation, retention, grievance route, processor terms, and breach notification support. Core obligations commence 13 May 2027.
CERT-In AI security guidelines
Risk tiering, human oversight, least-privilege tool use, 180-day log retention options, and support for six-hour incident reporting.
RBI / SEBI model-risk expectations
Kill switch, human-in-the-loop, explainability thresholds, model inventory, annual review support, and clear accountability for third-party models.
Agentic controls
Approval gates for money and promises, tool allowlists, cost caps, prompt/model versioning, eval sets, and a fallback that ends with a human.
Responsible AI statement
No fully autonomous high-stakes decisions. No training on client data. No invented credentials. Human review where the output could affect a person’s money, rights, or safety.
Subprocessors
Who touches
the data.
A current list is included in client DPAs and available on request. We notify clients before adding a new subprocessor that handles personal data.
| Category | Provider | Purpose | Data |
|---|---|---|---|
| Booking | Calendly | Scheduling discovery calls | Name, email, company, answers, meeting time |
| Meetings | Google Meet / Workspace | Video calls and email | Name, email, meeting metadata |
| Hosting | Your cloud or ours (AWS/GCP/Vercel) | Run the workflow and store logs | Per the data map in the SOW |
| Models | OpenAI / Anthropic / Google | Language and extraction steps | Only the minimum context needed; no training |
| Messaging | WhatsApp Business/BSP; Discord/Telegram; Signal bridge | Customer conversations | Phone number, message content, consent status |
| Analytics | Cloudflare Web Analytics; Plausible/Umami if enabled | Aggregate site usage | No cookies; aggregate request data, no individual profile |
Third-party providers process data under their own terms and our DPAs. We do not sell personal data. WhatsApp/Meta message charges and model API usage are external costs, not part of our fees; Discord, Signal, and Telegram have no per-message platform fee but may need hosting or bridge costs.
Procurement pack
The documents
your IT team wants.
We can provide a mutual NDA, DPA, security questionnaire, data-flow diagram, subprocessor list, sample SOW, and a redacted runbook. Ask for the pack and we’ll send it within one business day.
Request the packA note on claims
We are not ISO 27001 or ISO 42001 certified, and we don’t claim to be. We design to support your compliance obligations and we document what we do. If a client requires certification, we’ll tell you honestly whether we can meet it before you sign.
This page is a summary, not legal advice. The signed DPA and SOW govern.