Security & data

Confidentiality first

• We sign a mutual NDA before you share details.
• Our contracts bind our team and any subcontractors to confidentiality.
• We don’t name you as a client or show your work publicly without your written permission.

You own what we build

Code, designs, documentation and infrastructure we create for you are assigned to you under the contract. We document the work so any team can carry it on, and we list the open-source components we use with their licences.

Work happens in your accounts

Wherever possible we work inside your code host (GitHub, GitLab or Bitbucket), your cloud account and your tools, so you control access from day one. If a project starts in our repositories, we transfer them to you at handover.

Access control

• Everyone gets a named account. No shared logins.
• Least privilege: each person can reach only the systems their role needs.
• Multi-factor authentication on code hosts, cloud consoles and email.
• Production access only when you agree to it.
• When the engagement ends, we remove all of our access and confirm it in writing.

Handling your data

• We build and test with synthetic or anonymised data wherever we can.
• We use production personal data only when the work needs it, you have agreed, and it stays in your environments.
• Secrets such as API keys, passwords and tokens live in a secrets manager or environment configuration, never in code or chat.
• When the work ends, we return or delete your data and confirm it.

AI tools and your data

AI agents speed up our work, and we are explicit about how.

• Before work starts, we agree with you which AI tools and model providers may process your code or data.
• Where your agreement requires it, we use only providers whose business terms exclude your data from model training.
• We never put your confidential data into tools you haven’t approved.
• Every AI-written change is reviewed by an engineer and covered by the same tests as any other code.

Engineering practices

• Every change goes through code review and automated tests before it ships.
• Dependencies are kept up to date and checked for known vulnerabilities.
• Infrastructure is defined as code where practical, so changes are reviewable and environments can be rebuilt.
• Data is encrypted in transit, and at rest using your cloud provider’s controls.
• Systems we run have logging, monitoring and alerts that reach a person.

When we process personal data for you

If our work involves personal data you control, we act as your data processor: we follow your documented instructions and sign a data processing agreement covering India’s DPDP Act and, where they apply, the GDPR and standard contractual clauses for international transfers.

If something goes wrong

If we become aware of a security incident affecting your data or systems, we tell you without undue delay, and within 72 hours, with what we know. Then we work with you on containment, fixes and any notifications the law requires.

Certifications and security reviews

We don’t hold ISO 27001 or SOC 2 certification today. We can work within your security policies, complete your vendor security questionnaire, and align delivery with your compliance requirements.

Reporting a vulnerability

If you find a security issue on solvepact.com or in one of our products, please email us before disclosing it publicly. We will acknowledge your report and keep you updated while we fix it.

Contact

For security questions, questionnaires and vulnerability reports: