Everything you need to complete your security review.

One or more annual third-party audits

ISO 27001 and SOC 2, independently audited

Third-party penetration testing

Twice a year · latest 12 May 2026

Nine named, with 30-day change notice

Deletes customer data on request

Propagates through backups within 7 days

Component-level, 99.99% uptime SLA

Encrypted in transit and at rest

TLS 1.3 · SRTP AES-256 · AES-256 at rest

India-only data residency available

ap-south-1 pinned, no replication out

SSO / SAML and enforced MFA

Plus IP allow-listing on console and API

Formal mobile device management programme

Encrypted disks, remote wipe on all issued devices

Disaster recovery plan

RTO 30 s · RPO 5 min · drilled quarterly

Cyber liability insurance

Certificate available under NDA

REST + VobizXML, OpenAPI spec published

v4.1 · versioned with change history

No — customer audio used for model training

Contractually prohibited, sub-processors included

No — PCI DSS certification

No cardholder data stored, so out of scope

No — public bug bounty

Private disclosure programme with safe harbour