Trust
Security and data
Here is what happens to your systems and information during a project, and the standards our engineers work to. Security reviewers can use it as a first pass before asking for documents.
Access and environments
- Least access
- Each person gets the minimum they need in each environment, and it is withdrawn when the phase ends.
- Production data stays put
- It is never copied to a developer's machine.
- Your cloud accounts
- Environments run in your own cloud accounts, billed to you.
- Your repository
- Work goes into your repository from the first commit.
Data in transit and at rest
Connections use TLS 1.2 or higher. Stored data is encrypted by your cloud provider, and sensitive fields get their own encryption where the data warrants it. Before a contract is signed we send you the list of outside processors the architecture uses.
Testing before go-live
The Prove phase of every project covers a threat model, a penetration test and a dependency audit, followed by a walkthrough of the findings with your team. Load and failover drills run alongside. The five phases
AI systems and your data
Client data does not train models. Where a model is called through an outside API, contracts use the provider's zero-retention tier. Each AI system we build has a written data boundary that says which data the model sees.
Incidents
Incident response uses defined severity levels and named escalation contacts, with a notification commitment set in your service agreement. Every incident ends with a written review.
Where your data lives
Where data is stored is decided in discovery, against the rules for your sector. Banking and payment data, regulator outsourcing directions, government hosting policies and the Digital Personal Data Protection (DPDP) Act each shape the choice. Compliance guide
DPDP Act
Any system we build that holds personal data gets consent records, a stated purpose for each field, retention rules and a way to erase a person's data. Naming a grievance officer is a launch-checklist item for each such platform. If the system will hold personal data in volume, a short scoped assessment comes first.
How we treat the data you send us is in the privacy notice, with a route for requests on the grievance page.
Who owns the code
On custom work you own the source code from its first commit, held in your own repository and organisation, and Brihat charges no licence to run it. Products we license, such as Brihat EHS, stay ours and come with a licence for you.
Engineering standards
A change counts as done when:
- someone other than its author has reviewed it
- tests cover the paths that cost most when they fail
- it runs in a live environment
- the documentation changed in the same commit
- it can be observed in production
- it meets acceptance criteria agreed beforehand
Changes are small and merge often. Releases are automated and reversible. We keep dependencies few and audit them. Design decisions are recorded as short notes in the repository. Web work is tested against WCAG 2.2 level AA.
Standards held
Brihat Infotech holds ISO/IEC 27001, the standard for managing information security, and ISO 9001, the standard for managing quality.
Documents on request
Write to us and we will send:
- our security posture pack
- the processor list for your project's architecture
- our standard master services agreement, data processing agreement and non-disclosure agreement
To report a vulnerability in our site, use the address in our security.txt.
Send us your security questionnaire
Tell us what you want to build.
The first call is 45 minutes with an architect, usually the founder. It is free, and we will sign an NDA first if you ask.