Clients trust us with their customers, calls, bookings, and business data. We apply security by design: controls are built into how we plan, build, and operate, not added at the end. Our programme follows recognised frameworks, including the OWASP Top 10 / ASVS, NIST Cybersecurity Framework, and CIS Controls, and is designed to support clients' ISO/IEC 27001 and SOC 2 expectations. [VERIFY] (State certification only if you hold or are in a formal audit process for it.)
- Accountable ownership. A named security lead is responsible for the security programme and reports to leadership.
- Policies. A written information security policy set, reviewed at least annually, covers acceptable use, access control, incident response, vendor management, and data handling.
- Personnel screening. Background checks are carried out on personnel with access to client data, where permitted by law.
- Confidentiality. All staff and contractors sign confidentiality agreements.
- Training. Security and privacy awareness training at onboarding and annually, with role-specific secure-coding training for engineers.
- Encryption in transit: TLS 1.2+ for all data in transit.
- Encryption at rest: AES-256 or equivalent for production databases, storage, and backups.
- Key management: Keys are managed through the cloud provider's key management service, with restricted access and rotation.
- Data minimisation. We collect and retain only what each engagement needs.
- Tenant separation. Client environments and data are logically separated.
- Retention and deletion. Data is retained for the period agreed with the client and securely deleted or returned at end of engagement, as set out in the DPA.
- Non-production data. Production personal data is not used in development or testing unless anonymised or explicitly authorised.
- Least-privilege, role-based access, with access reviews at least [quarterly].
- Multi-factor authentication on all administrative, cloud, source-control, and email accounts.
- Single sign-on and centralised identity management where supported.
- Prompt access removal on role change or departure.
- Privileged access is logged and limited to what is needed.
- Requirements and design include threat-modelling for higher-risk features.
- Peer code review and protected branches; no direct production commits.
- Automated dependency scanning, static analysis (SAST), and secret scanning in CI/CD. [VERIFY]
- Separate development, staging, and production environments.
- Infrastructure defined as code; changes tracked and reviewable.
- Independent penetration testing of key products at least annually and after major changes. [VERIFY]
- Vulnerabilities are triaged by severity and remediated within target timelines: Critical [7 days], High [30 days], Medium [90 days].
- No training on client data by Scalric or by third-party model providers on our behalf, unless the client agrees in writing. We configure provider settings and use contractual or enterprise API terms to this effect. [VERIFY]
- Controls against prompt injection, data leakage between sessions or tenants, and unsafe tool use, including input and output filtering and limited-scope credentials for model-connected tools.
- Human-in-the-loop and escalation paths for sensitive actions (payments, cancellations, clinical or legal content).
- Voice and call data (for AI phone agents) is processed under the client's consent settings, with recording and transcript retention configured per client.
- Evaluation and monitoring of model behaviour for accuracy, bias, and misuse.
- Hosted on major cloud providers [AWS / Google Cloud / Microsoft Azure] with data-centre certifications including ISO 27001 and SOC 2. Region selection is available to meet data-residency requirements.
- Network segmentation, firewalls and security groups, and WAF protection for public applications.
- Endpoint protection, disk encryption, and automatic patching on company devices.
- Logging and monitoring: centralised logs with alerting on suspicious activity, retained for [12] months.
- Backups: encrypted, automated, and restoration-tested at least [annually].
- Business continuity: documented recovery objectives (RPO and RTO) for hosted products, available on request.
We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. In the event of a confirmed personal data breach affecting client data, we notify the affected client without undue delay and in any event within 48 hours of confirmation (contractual commitments may specify shorter periods), with the information needed to meet the client's regulatory obligations.
Third parties that handle client data are assessed before onboarding and periodically after, for security posture, certifications, and contractual protections. Our current sub-processor list is available on request at security@scalric.com and in the DPA.
We design our services to help clients comply with applicable data protection laws, including India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR, and, where relevant, HIPAA for healthcare engagements (under a Business Associate Agreement) and PCI DSS (we do not store full card data; payments are handled through PCI-compliant providers). [VERIFY] (Keep only what applies.) See our Privacy Policy and Data Processing Addendum.
On request, and under NDA where appropriate, we can provide: a security questionnaire response (CAIQ, SIG-Lite, or custom), a summary of our latest penetration-test results, our sub-processor list, and our DPA.
See our Responsible Disclosure Policy or email security@scalric.com.
Security contact: security@scalric.com