Security & Data Residency
Where Ivy Digital stores customer data, how it is protected, and what customers are responsible for.
1. Data location
Primary customer data storage and backups are hosted in data centres located in Mumbai, India. This applies to the production databases and object storage used by Ivy Digital products, subject to the product-specific retention and configuration settings described in the Privacy Policy.
Support and engineering staff may access systems remotely from the UAE or other locations where necessary to operate, support and secure the services, under access controls and confidentiality obligations.
2. Infrastructure and tenancy
- Production workloads run on managed cloud infrastructure in Mumbai, India, with encrypted backups.
- Products use logical tenant isolation so that customer workspaces, files and records are separated.
- Access to production systems is restricted to authorised personnel with role-based permissions and multi-factor authentication.
3. Encryption
- Data in transit is encrypted using TLS 1.2 or higher.
- Data at rest is encrypted using AES-256 or equivalent provider-managed encryption.
- Sensitive credentials and API keys are encrypted; customer-provided model credentials are stored encrypted.
4. Access control and monitoring
- Role-based access control across products, with least-privilege principles.
- Multi-factor authentication for privileged and administrative access.
- Audit logging of administrative actions and selected product events.
- Monitoring and alerting for availability, errors and suspicious activity.
5. Backups and resilience
- Encrypted backups are taken regularly and retained on a rolling basis (typically up to 90 days).
- Restore procedures are tested periodically.
- Production changes follow a release process with rollback capability.
6. Secure development and vendor management
- Dependencies and infrastructure are patched and reviewed regularly.
- Security issues are triaged and remediated according to severity.
- Sub-processors are assessed for security and data-protection posture; the current list is on the Sub-processors page.
- We do not currently claim third-party certifications such as ISO 27001 or SOC 2. Where a customer requires certification, we will discuss scope and timing openly.
7. Incident response and notification
We maintain an incident-response process covering triage, containment, eradication, recovery and post-incident review. If a personal-data breach occurs, we notify affected customers without undue delay and, where feasible, within 72 hours of confirmation, with the information required by applicable law and the DPA.
8. Customer responsibilities
- Manage user access, roles and offboarding within your account.
- Configure retention, recording and approval settings appropriate to your risk and legal obligations.
- Ensure lawful bases, notices and consent for personal data you submit — particularly employee, candidate, call-recording and marketing data.
- Protect API keys, integrations and administrator credentials.
- Review AI outputs before relying on them in HR, tax, compliance and quality decisions.
9. Data export and deletion
Customers can export data using product features. On termination, data is deleted within 90 days except where law requires longer retention (for example tax records, which may be retained for up to 5 years) or in rolling encrypted backups that expire within 90 days.
10. Contact
Security reports: [email protected]
DPA and data-protection enquiries: [email protected]