Security and compliance

Why this page is detailed

Controls

Access

Engineers work under your identity provider where you have one, with named accounts, multi-factor authentication and least-privilege roles. No shared logins, no generic vendor accounts. Access is requested per engagement and revoked on the last working day.

Devices

Company-managed laptops with full-disk encryption, endpoint protection, automatic patching and screen-lock policy. No work on personal machines. Devices are wiped and re-imaged between engagements.

Production data

Not on developer machines. Where development needs realistic data we use masked or synthetic datasets. Production access, when a role genuinely requires it, is named, time-boxed, logged and approved by you.

Code and secrets

Your repositories, your branch protection, your secret manager. We do not hold client secrets outside your systems, and we do not copy repositories to our own infrastructure.

Network

Work happens from managed offices and managed home setups with enforced VPN where you require it. We can restrict access to named static egress addresses for allow-listing.

People

Identity, education and employment verification before placement. Confidentiality and IP assignment in every employment contract. Security awareness training on joining and annually. Role changes and exits trigger an access review.

Sub-processors

A named list, provided before contracting and updated with notice. We do not introduce a new sub-processor that touches your data without telling you.

Incidents

A written incident response procedure with defined severities and notification timeframes in the agreement. You hear about anything affecting your data from us, quickly, including when the answer is still incomplete.

Documentation by market

What we hand your reviewer, depending on where you are

United States

SOC 2 Type II report under NDA, ISO 27001 certificate and scope statement, W-8BEN-E, certificates of insurance, background-screening description, and our standard DPA.

United Kingdom

ISO 27001 certificate, our DPA with the ICO's International Data Transfer Agreement or the UK Addendum attached, input for your transfer risk assessment, a DPIA information pack, and our sub-processor list. Cyber Essentials status on request.

European Union

DPA under Article 28, the 2021 standard contractual clauses, and the technical and organisational measures schedule plus supporting information for your transfer impact assessment — including how access to data is restricted and encrypted on our side.

Australia

Our APP 8 pack: a description of where data is held and who can access it, the contractual commitments we make about handling it, our Essential Eight self-assessment, and an explicit written disclosure of offshore access for your own IRAP or internal scoping.

Canada

PIPEDA accountability terms in the DPA, and a completed input pack for a Quebec Law 25 privacy impact assessment where your entity is Quebec-based.

Gulf

Transfer clauses to match Saudi PDPL requirements and a UAE PDPL-aligned processing agreement, with a statement of where processing occurs and who can access it.

This page describes our own controls and the documents we provide. It is not legal or tax advice about your obligations, and nothing here should be read as a conclusion about how a particular regime applies to your organisation — your own advisers decide that, and we give them what they need to do it.

Legal entity

The entity you would contract with, and where to verify it

Vendor onboarding starts with proving the supplier exists. These are the registry facts, so your procurement team can confirm them without waiting on us.

Registered name

Skydream Digital Innovations (OPC) Private Limited

Corporate Identity Number

U62010PB2024OPC062301

Trading since

2010, under predecessor ownership before incorporation

Incorporated

20 August 2024, Punjab, India, as the present private limited company

Registered office

SB Tower, E-190, Industrial Area, Phase-8B, SAS Nagar (Mohali), Punjab 140301, India

Startup recognition

DIPP260187 — Department for Promotion of Industry and Internal Trade, Government of India. Issued 8 May 2026, valid to 19 August 2034.

The CIN is searchable on the Ministry of Corporate Affairs register and the recognition number on the Startup India portal. Certificates, the GST registration and a signed W-8BEN-E go to your reviewer on request — ask for them with the role brief rather than after it.

Questions

Security, data and contracts

Can we see the SOC 2 report?

Yes, under an NDA. We send the full report rather than a summary letter, because the report is what your reviewer actually needs. We do not publish the auditor or the reporting period on the website; both come with the report.

Can we verify the ISO 27001 certificate?

Yes. Ask and we send the certificate itself, with the certification body and certificate number so you can check it against the issuing registry, plus the scope statement — scope being the part most buyers forget to ask for. We do not put those details on a public page.

Will you sign our DPA instead of yours?

Usually, yes. We have our own, and we are comfortable working from your paper where your legal team prefers it.

Will you complete our security questionnaire?

Yes, and quickly — this group runs ISO and SOC programmes for other companies, so a long questionnaire is routine work for us rather than a three-week interruption.

Can you support work that cannot leave our country?

Not as offshore delivery, and we will tell you so rather than find a workaround. Where part of a programme is restricted — classified work, certain government data, some regulated financial or health data — we scope that out explicitly and work on the remainder.

Who owns the intellectual property?

You do, from the moment of creation, assigned comprehensively, exclusively, irrevocably and perpetually. It is not contingent on final payment.