Security and compliance at ReDesk

Privileged access to encryption keys is limited to authorised users with a business need.

Access to systems requires a unique account with a password or an authorised SSH key.

Production systems are reachable only through an audited bastion with time-bound approval.

Rulesets are reviewed at least annually and required changes are tracked to completion.

Customer data networks are segmented from corporate and build networks.

Monitoring raises alerts when predefined availability or latency thresholds are met.

MFA is required for every employee account and every administrative interface.

Access to production and customer data is recertified by system owners every quarter.

Permissions are granted by role, with separation of duties for payment approval.

Access is revoked within four hours of an employee or contractor leaving.

Minimum length, breach-list screening and rotation on compromise are enforced centrally.

Customers set session lifetime, idle timeout and IP allowlists for administrative access.

TLS 1.3 with modern cipher suites is enforced on every public endpoint.

AES-256 encryption is applied to databases, object storage and backups.

An independent penetration test is performed at least twice a year.

Every build is scanned for vulnerable dependencies, secrets and insecure patterns.

Changes require review and approval by a second engineer before they reach production.

Every query is scoped by organisation using row-level security, not application logic alone.

Reads, writes, approvals and exports are recorded and exportable to a customer SIEM.

Workspaces can be pinned to India, the EU or Singapore, including telemetry and documents.

Retention periods are documented per data class and enforced by automated deletion.

Data is deleted within 30 days of contract termination and purged from backups within 90.

KYC documents and payment mandates carry an additional encryption layer with separate keys.

Access, correction, erasure and portability requests are fulfilled within 30 days.

A personal data inventory and record of processing activities is reviewed annually.

Employees and contractors sign a confidentiality agreement at the time of engagement.

Background verification is completed for every employee before their start date.

Every employee completes security and privacy awareness training each year.

An MDM system enforces disk encryption, screen lock and anti-malware on every laptop.

A named security owner and a data protection officer are appointed and reachable.

The plan is documented, owned and exercised through a tabletop at least annually.

Production changes follow a documented, approved and reversible process.

Infrastructure is defined as code with drift detection and automated remediation.

Critical findings are remediated within 7 days and high findings within 30.

Security posture, incidents and risk acceptance are reported to the board twice a year.

Continuous replication with encrypted copies held in a geographically separate zone.

Restores are rehearsed against a 5 minute RPO and a 2 hour RTO, and results are recorded.

The plan is reviewed annually and covers people, offices, suppliers and field operations.

A full regional failover exercise is performed at least once a year.

Uptime, degradations and incident history are published on the public status page.

Vendors handling customer data are assessed before onboarding and annually thereafter.

The register is public and customers can subscribe to advance change notices.

A DPA with Standard Contractual Clauses is executed with every sub-processor.

Data return and deletion is confirmed in writing when a vendor is retired.

Customer content is never used to train foundation models, contractually and technically.

Generated documents are labelled, versioned and require human approval before they leave.

Providers appear in the sub-processor register with their retention and training terms.

Permitted uses, prohibited uses and escalation paths are documented for all staff.

Yes. AES-256 at rest, TLS 1.3 in transit, and an additional field-level encryption layer for identity documents and payment mandates. Keys are held in a managed HSM and rotated annually.

Primary residency is Mumbai. Enterprise workspaces can be pinned to Frankfurt or Singapore instead. Documents, telemetry and backups all stay in the chosen region.

Continuous replication with point-in-time restore to any second in the last 35 days. Restores are rehearsed quarterly against a 5 minute RPO and a 2 hour RTO, and the results are available under NDA.

Yes. Every query is scoped by organisation at the database layer using row-level security, so isolation does not depend on application logic being written correctly.

SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 27017 today. ISO/IEC 27701 is scheduled for Q1 2027. Certificates and reports are in the Documents tab.

Yes, under NDA. Use Request access on this page. Most requests are approved within one business day and the pack includes the report, the pen test summary and the network diagram.

Yes. We act as processor, offer a DPA with Standard Contractual Clauses on every paid plan, and maintain documented transfer impact assessments for each sub-processor outside the EEA.

Yes. Consent notices, purpose limitation, a published grievance officer and breach reporting are aligned to the Digital Personal Data Protection Act 2023.

SAML 2.0 with Okta, Entra ID, Google Workspace and any compliant provider, plus SCIM provisioning. Both are included on Growth and Enterprise, not sold as an add-on.

Yes. Stream events over webhook or pull them via API. Default retention is 13 months, and the schema covers reads, writes, approvals, exports and administrative changes.

No one holds standing access to customer content. Support and engineering access requires an approved ticket and a second approver, expires automatically, and is written to the audit log you can read.

Critical incidents are acknowledged within 1 hour, 24×7. Affected customers are notified within 24 hours of confirmation, and within 72 hours where personal data is involved. A written post-incident review follows within 10 business days.

We run a responsible disclosure programme with safe harbour and credit for researchers who want it. A paid bounty is on the published roadmap for 2027.

No. Customer content is never used to train foundation models. Our model providers operate under zero-retention, no-training terms, and they are named in the sub-processor register.

Yes. An admin can disable AI drafting and summarisation for the whole workspace. Everything else in the platform continues to work unchanged.

CAIQ, SIG Lite and VSA Core are already completed and available under NDA, which answers most reviews outright. Custom questionnaires are completed for Enterprise deals, typically within five business days.

Yes, including cyber liability and professional indemnity. Certificates of insurance are provided under NDA on request.