Written for the person who has to sign this off
Where your data lives, who can touch it, what we'll sign, and (the part vendors usually leave out) what we haven't done yet.
The physical controls are most of the answer
For this kind of work, a supervised room does more for your data than a certificate does. Here is what that means concretely.
Work happens on our machines
Client work runs on company laptops in our office. No personal devices, no working from home on your data, no files on a phone.
One room, supervised
The floor is a single supervised space. Anyone touching your process is a named employee we can identify on request.
Removable media is restricted
A written policy prohibits USB storage and personal cloud accounts on work machines, enforced by the floor supervisor. Where a task genuinely needs export, it goes through a channel agreed with you.
Nothing goes to an outside model without your say-so
Some tasks go faster if a machine takes the first pass. Any tool that would send your data to an outside API is named in the scope and switched on only if you agree in writing. By default, anything automated runs on our own machines, on our premises, and is deleted with the rest of your batch.
Access ends with employment
Accounts are provisioned per person per client, and revoked the day someone leaves the seat, not at the end of the month.
Kept separate per client
Each client's data, logins and workspace stay separate. People work only on the processes named in their scope. No shared credentials, and no cross-client access.
What we'll sign before you send anything
All of this is available before a pilot, not after. Ask and we'll send the drafts.
- Mutual NDA before we see any sample data
- Individual confidentiality undertakings signed by every person on your process
- A written scope naming which staff may access what
- Deletion or return of your data on request, and at contract end by default
- Named point of contact for any incident, with a same-day response commitment
DPDP Act, in plain terms
The Digital Personal Data Protection Act, 2023 governs personal data in India. If your batches contain personal data, this is the shape of the arrangement.
- You are the Data Fiduciary
- You decide why and how the data is processed. Consent, notice and the lawful basis sit with you, and we don't use your data for anything other than your task.
- We are a Data Processor
- We act only on your written instructions, under contract, with the access controls above, and we delete or return the data when you tell us to, or when the contract ends.
- We are not a data controller for you
- We process what you send us, on your instructions, for your purposes. Your privacy notice and lawful basis stay yours.
- We do not subcontract without telling you
- Your work stays on our floor. If a task ever needed an outside specialist, you would be asked first, in writing.
This is a description of how we work, not legal advice. Your counsel should review any agreement before you sign it.
The gaps, before you find them
We are not ISO 27001 or SOC 2 certified
Those are real, expensive audits and we have not done them. Anyone our size claiming otherwise is worth a second look.
We do not run device-level DLP
Removable media and personal cloud accounts are controlled by written policy and floor supervision, not by endpoint software. If your process needs technical enforcement, say so at scoping and we will quote it honestly.
We do not have 24/7 cover
We run one shift. Overnight or weekend turnaround needs to be agreed in advance and staffed for. We would rather decline than quietly miss it.
We have no second site
One floor, one city. A prolonged outage there stops delivery. If your process needs continuity guarantees across locations, we are not the right vendor yet.
If your process needs something stricter
Some clients need controls we don't have yet: a segregated room, device-level DLP, or a specific certification. Tell us at scoping.
If it's something we can put in place for your engagement, we'll quote it honestly. If it isn't, we'll say so and you can go elsewhere with two weeks intact rather than two months.
Ask for the drafts before you commit to anything
The mutual NDA and the individual confidentiality undertakings are available now, not after a contract. Ask and we'll send them.