A trusted IT partner, verified in your own systems.

Evidence you hold yourself. A trusted IT partner works through your identity provider, under your keys and in view of your audit log, so every session and change can be checked in your own systems; it writes each commitment into the contract; and it can be verified on a public register. Reputation and badges help, and none of them replaces a record you can read.

Standing access, data copied outside your control, code you do not own and an exit nobody planned. Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches. Each risk has a control: access that is requested, approved and closed; data processed only in your environment; IP assigned on creation with the repository in your organization; and a hand-back agreed before the work starts.

At least these: named accounts through your SSO with phishing-resistant MFA, just-in-time and least-privilege access, encryption with keys you hold, no production data on laptops, masked data outside production, secret and dependency scanning, an SBOM with every release, tested backups, and every action logged where you can read it. Every one of them is on this page, with where you check it.

Only the engineers named for your work, through access you grant for a task and a window, and can revoke at any moment. Each session runs through your identity provider and is recorded in your own audit trail, so you can see who reached what, when, without taking our word for it.

No. We never train on your data, and every model provider we call is contracted and configured so it does not either: enterprise endpoints with zero data retention, or open-weight models running inside your environment. It is written into the data processing agreement.

Only the provider named in writing for your work, listed among the third parties we return with your questionnaire, called on an enterprise endpoint with zero data retention. Where nothing may leave your perimeter, open-weight models run inside your own environment and no provider sees your data at all.

The same way as people: named, scoped, approved and recorded. Each agent holds credentials for an allow-list of tools, anything consequential waits for a person, and every action is written to your audit log with its inputs, decision, approver and result. Agents are tested against the OWASP Top 10 for LLM and agentic applications before release and after.

You do, from the moment it is written. Our agreement assigns all work product to you on creation, worldwide and permanently: the code, and also the prompts, evaluation sets, vector indexes and any fine-tuned weights. No clause lets anyone hold delivered work back.

You do, by contract. The assignment covers all work product however it was written, including code drafted with AI assistants, and that code sits in your repository from the first commit, reviewed by an engineer before it merges.

Yes, and with us it does from the first commit. The repository lives in your GitHub or GitLab organization, and we work inside it as collaborators. The cloud accounts, billing and root credentials are yours too.

Everything stays with you, and our access closes. The hand-back is agreed at the start: code, infrastructure as code, keys, runbooks and records are already in your systems, working copies are returned or destroyed, and you receive written confirmation. Your systems keep running exactly as before.

Yes. Send your SIG Lite, CAIQ, AI-CAIQ, AI vendor questionnaire or your own, and we return it with our policies, the list of third parties that would touch your data and a data-flow drawing for your system. Answering it before any access keeps procurement moving.

Where the data goes and who can see it; whether it trains any model; which model providers are used and on what retention terms; how agents are limited and who approves their actions; how outputs are tested and red-teamed; what is logged and where; and who owns the prompts, indexes and weights. This page answers each of them for DigyAi.

Yes, before any technical detail is shared. We work from your paper or ours, add the EU standard contractual clauses, the UK IDTA or the UK Addendum where your data requires them, and incident notice runs on the terms of your DPA, in writing.

The subject, duration, nature and purpose of the processing; the types of data and people involved; the processor's duties on security, confidentiality and assistance; the approved sub-processors and how changes are notified; breach notice terms; audit rights; international transfer safeguards such as SCCs; and return or deletion at the end. Ours covers each, and your legal team is welcome to strengthen any of it.

Our work runs inside your environment, so the controls your auditor already tests are the ones that govern us. We do not hold a separate certificate of our own. The practice that meets your SOC 2, ISO 27001, ISO/IEC 42001, HIPAA or GDPR controls is written into the contract, and its evidence sits in your systems, where your auditor can check it.

By working inside your controls and putting what each regulation asks of a supplier into the contract: a GDPR Article 28 DPA with transfer clauses, the information your DORA register of information needs along with audit and exit terms, a business associate agreement where HIPAA applies, and for the EU AI Act the documentation, logging and human oversight your use case requires.

DigyAi Technologies (OPC) Private Limited is registered with India's Ministry of Corporate Affairs under CIN U62099RJ2025OPC105518. Search the company master data on mca.gov.in with that number; the registered office and directors are public record.

Their access is removed and logged the same day, and the work carries on. Everyone on your work is named in the proposal, a change needs your written approval, and the code, decision records and runbooks live in your repository from day one, so the knowledge stays in the system.

Write to contact@digyai.com with "Security" in the subject line; the same contact is published in our security.txt file at /.well-known/security.txt. You get a reply within one business day.