1. Our approach
Your employee and business data is at the centre of every USR INFOTECH Platform. We protect its confidentiality, integrity and availability through an information security management system certified to ISO/IEC 27001:2022, and we govern our AI through a management system certified to ISO/IEC 42001:2023. Both are audited independently every year.
2. Certifications and data protection
| Standard | Status | Detail |
|---|
| ISO/IEC 27001:2022 | Certified | Information security management. Certificate 305024062450IST, issued by QRO. |
| ISO/IEC 42001:2023 | Certified | AI management. Certificate UQ-2025072543, issued by UKcert. Scope: performance management, talent management and OKR platforms. |
Data protection laws. We support your obligations under India’s DPDP Act, 2023 and the EU GDPR with data processing agreements, a choice of India or EU hosting, a published list of sub-processors, and help with data access, correction and erasure requests.
Our certifications cover the environments we operate. For audits and vendor risk assessments, see InfoSec, Audits & Risk Assessments.
3. Hosting and infrastructure
- Hosting in India: Amazon Web Services, Mumbai region. AWS maintains its own ISO 27001 certification and SOC reports for its data centres.
- Hosting in the EU: Hetzner Online data centre parks in Germany (Nuremberg and Falkenstein). Hetzner’s ISO/IEC 27001:2022 certification covers the infrastructure and operation of these sites, with 24/7 video-monitored perimeters, electronic access control, redundant power and fire detection.
- Data residency: Customers can choose India or EU hosting to meet the DPDP Act, GDPR or internal policies.
- Dedicated deployments: on request, we can host a Customer on another leading cloud provider, such as Google Cloud, Microsoft Azure or DigitalOcean, in a region the Customer chooses, or deploy in the Customer’s own private cloud or on-premises data centre, for example where sector rules or data localisation require it.
- Backups and recovery: automated daily backups and a documented business continuity and disaster recovery plan.
- Network protection: firewalls and restricted administrative access to production systems.
4. Platform security
- Encryption: data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256.
- Access control: role-based permissions, single sign-on with Google and Microsoft, multi-factor authentication and IP restrictions where configured.
- Tenant isolation: each Customer’s data is logically separated from every other Customer’s.
- Secure APIs: token-based authentication for integrations and API access.
- Audit trails: logs of user and administrator activity to support monitoring and investigations.
- Session controls: automatic logout after inactivity.
5. Application security
- Secure development: security is reviewed through design, code review and testing before release.
- Vulnerability management: code analysis, regular vulnerability assessments and penetration testing.
- Patch management: security updates are applied to systems and dependencies on a defined schedule, with critical fixes prioritised.
6. AI security and governance
Our ISO/IEC 42001 management system covers how we design, test and monitor AI features. AI use cases go through risk and impact assessment, outputs are designed for human review, and Customer Data is processed only to deliver the feature the Customer uses. Each large language model provider is reviewed for security, data handling and data location before we add it, and only the content needed for each request is sent. Customers can choose the model or provider where we offer a choice. We do not use Customer Data to train general-purpose AI models.
7. People and suppliers
- Confidentiality agreements with employees, contractors and partners.
- Security awareness for our team, and least-privilege access to production data.
- Security and data protection terms in supplier and partner contracts, with periodic supplier reviews.
- A non-disclosure agreement with every prospective partner before any product access, demo environment or technical detail is shared.
- Partner Apps offered by USR are reviewed against our security requirements before listing, with stricter requirements for apps offered to enterprise customers.
8. Incident response
We follow a documented process to detect, contain, investigate and recover from security incidents. If an incident affects Customer Data, we notify the affected Customer without undue delay and share what we know, so they can meet their own legal obligations.
9. Shared responsibility
Customer-hosted deployments: where our software runs in a Customer’s own private cloud or on-premises data centre, the Customer is responsible for that infrastructure, its physical and network security, backups and access. Our certifications cover our own processes, including development, release and support, but not the Customer’s infrastructure. Our support access is granted, logged and controlled by the Customer.
Security works best as a partnership. We ask Customers and Reseller Partners to:
- enable single sign-on or strong password policies, and review user access regularly;
- remove access promptly when employees leave;
- train users to spot phishing and keep devices secure;
- report suspected security issues to us immediately.
10. Reporting a security issue
If you believe you have found a vulnerability or security issue, please email support@usrinfo.tech with the subject “Security concern – [your organisation]”. Please include steps to reproduce it, and give us reasonable time to fix it before any disclosure. We will acknowledge your report and keep you updated.
