Security

1.Our approach

Security is part of how we design and deliver every project, not an afterthought. We match safeguards to the sensitivity of the data and the system, and agree specific requirements with you in the project proposal.

2.Access to your data

• Access follows the least-privilege principle: only what’s needed for the task, only for the people working on it.
• We use multi-factor authentication on the accounts we use for client work, wherever the platform supports it.
• Access is removed when an engagement ends.
• Anyone who works on client projects with us is bound by confidentiality obligations.

3.Data in transit & at rest

• Our website and the applications we build use HTTPS (TLS) to encrypt data in transit.
• We enable encryption at rest using the cloud provider’s built-in features where available, for example on Amazon S3 and DynamoDB.
• Passwords, API keys and other secrets are kept out of source code and stored in a secrets manager or environment configuration.

4.Working in your environment

• Wherever possible, we build and run solutions in your own cloud account, so you keep ownership and control.
• We avoid copying production data unless it’s needed, and use sample or anonymised data where practical.
• At the end of an engagement, we return or delete project data as agreed.

5.Secure development

• Code lives in version control, with a clear history of every change.
• Changes are reviewed and tested before release, and released through repeatable deployment pipelines where set up.
• We keep dependencies up to date and apply security patches during active support periods.

6.AI-specific safeguards

• AI solutions only receive the data they need for the task.
• We review data-handling settings of AI providers, such as Amazon Bedrock or OpenAI, with you before going live.
• Sensitive, high-impact or customer-facing actions include a human review step.
• We never use your data to train or improve our own models or products.

7.Cloud providers

Our solutions are typically hosted on established cloud platforms such as AWS. These providers operate their own security programmes for their infrastructure. We’re responsible for configuring their controls correctly for your solution.

8.If something goes wrong

If we become aware of a security incident affecting your data, we will:

• Act promptly to contain it and limit its impact.
• Notify you without undue delay, with what we know and what we’re doing about it.
• Meet any notification obligations under applicable law, including the Digital Personal Data Protection Act, 2023.
• Review what happened and improve our safeguards.

9.Certifications

We don’t currently hold formal security certifications such as ISO 27001 or SOC 2. If your project needs certified controls or must meet specific regulatory requirements, please tell us early. We’ll discuss how to meet them, including working with experienced specialist partners.

10.Report a security concern

If you believe you’ve found a vulnerability in our website or a system we’ve built, please email info@predefined.in with “Security” in the subject line. Include enough detail for us to reproduce the issue.

Please give us reasonable time to investigate and fix it before sharing it publicly, and don’t access or change data that isn’t yours. We’ll acknowledge your report and keep you updated.