Security & Compliance

How we protect your code, data and systems

Before you let an outside team into your repositories and cloud accounts, you need to know exactly what they will and will not do with that access. This page answers that in plain language — including the things we do not have.

Confidentiality: Mutual NDA before anything is shared
Intellectual property: Code and work product assign to you
Personal data: India DPDP Act; GDPR as a processor
AI tools: Business accounts, no training on your code

Contracts

Confidentiality and intellectual property

Mutual NDA first. We sign a mutual non-disclosure agreement before you share anything confidential, including at proposal stage. We are happy to sign your paper rather than ours.
Every employee is bound. Everyone who joins Zorvix signs a confidentiality undertaking as part of their employment contract, and it survives the end of their employment.
Your intellectual property stays yours. Source code, designs, documentation and other work product created for you assign to you. We claim no licence over your business logic or your data.
Pre-existing and open-source components are declared. Where we reuse our own libraries or open-source packages, we tell you which ones and under which licence, so your legal team is never surprised.

Access

Who can reach your systems, and how

Named accounts only. Individual logins for every person — never a shared account — with multi-factor authentication wherever the system supports it.
Least privilege. People get the access their task needs and no more, and standing production access is the exception rather than the default.
Your tenancy, your control. We prefer to work inside repositories and cloud accounts that you issue and can revoke at any moment.
Same-day removal. Access is withdrawn on the working day someone leaves the project or the company.
Devices. Full-disk encryption, automatic screen lock, patched operating systems and browsers, and credentials kept in a password manager — never in chat, email or source code.

Data

How we handle your data

We work in your environment where we can. Repositories, cloud accounts and databases stay under your ownership. We are users inside your tenancy, not a copy of it inside ours.
Production data does not travel. Development and testing use masked or synthetic data. Where a defect genuinely requires production data, it is accessed in place, with your approval, and not copied to our machines.
Personal data. We comply with India's Digital Personal Data Protection Act, and act as a processor under GDPR where your users are in the EU or UK, under a written data processing agreement.
Retention. At the end of an engagement we return or destroy the client material we hold, and confirm it in writing when you ask.

AI tooling

How AI is used on your work

Business accounts with training disabled. We use paid business tiers of AI coding and analysis tools, configured so that your code and content are not used to train public models.
Senior review of every output. AI-assisted work is reviewed by a senior engineer before it reaches your repository. The engineer who submits the change is accountable for it.
Your policy wins. If your organisation restricts or prohibits AI tooling on your codebase, we work to your rules and say so in the engagement agreement.

Delivery

Keeping the work itself safe

Change review. Changes reach production through a pipeline with peer review, automated testing and a documented rollback path — not by hand on a Friday evening.
Testing for security. Vulnerability assessment and penetration testing are available as part of QA as a Service, with findings ranked by exploitability.
Backups you have restored. Where we run your databases, backups are verified by restore and recovery is rehearsed, not merely documented.

What we do not have

We are not ISO/IEC 27001 or SOC 2 certified. We follow the practices on this page, we will complete your security questionnaire, and we will sign up to your controls in the contract — but we will not claim a certification we do not hold.

If a certification is a hard requirement for your procurement process, tell us at the first conversation. It is better to know in week one than in week six.

Security

Have a security questionnaire?

Send it over. We will complete it properly, and tell you up front where the answer is no.