Data Security & Compliance

Ashentrix is committed to protecting client, customer, employee and business information against unauthorized access, use, disclosure, alteration, loss and disruption. Our security approach is based on risk management, least-privilege access, confidentiality, operational controls, secure technology practices and continuous improvement.

We seek to maintain documented policies and procedures appropriate to the nature and scale of our operations. Security responsibilities are assigned to appropriate personnel, and security considerations are incorporated into operational processes, technology management and client engagements.

Security requirements may include access management, asset management, incident management, vendor management, business continuity, data handling and employee awareness.

Ashentrix applies access controls designed to limit information and systems access to authorized personnel with a legitimate business need. Controls may include role-based access, unique user credentials, authentication mechanisms, privileged-access restrictions, periodic access review and timely removal of access when personnel change roles or leave the organization.

Information is handled according to its nature, purpose, sensitivity and contractual requirements. Ashentrix seeks to minimize unnecessary access and use, maintain appropriate controls around data transfer and storage, and protect confidential information throughout its lifecycle.

Where Ashentrix processes personal data for a client, the applicable MSA, SOW, Data Processing Agreement and client instructions govern the permitted processing and security requirements.

Where appropriate to the system and service, Ashentrix uses encryption and secure transmission mechanisms to protect information in transit and, where supported by the relevant environment, at rest.

Specific encryption algorithms, key-management arrangements and technical configurations may vary by platform, client environment and contractual requirements.

Ashentrix uses reasonable technical controls to protect systems and endpoints against unauthorized access and malicious activity. Depending on the environment, controls may include endpoint protection, secure configurations, network controls, vulnerability management, logging, monitoring, patch management and controlled administrative access.

Relevant systems may generate security, access, operational and audit logs. Monitoring and review practices are designed to help identify suspicious activity, investigate incidents, support operational accountability and meet applicable contractual or legal requirements.

Ashentrix maintains processes for identifying, assessing, containing, investigating and responding to suspected security incidents.

Where an incident affects client information or services, notification, escalation, investigation and remediation will be handled in accordance with applicable law and the relevant contractual commitments, including any agreed incident-notification timelines.

Ashentrix recognizes the importance of maintaining continuity of critical business operations. Business continuity and recovery measures may include operational contingency planning, backup procedures, alternate working arrangements, technology recovery measures and defined escalation procedures.

Specific Recovery Time Objectives (RTOs), Recovery Point Objectives (RPOs) and disaster-recovery commitments are service- and client-specific and should be established contractually where required.

Personnel with access to Company or client information are expected to follow applicable security, confidentiality and acceptable-use requirements. Security awareness may include confidentiality obligations, password and authentication practices, phishing awareness, data handling, incident reporting and role-specific training.

Ashentrix treats client and business information as confidential where required by contract, law or the nature of the information. Employees, contractors and relevant service providers may be subject to confidentiality obligations appropriate to their role.

Where third-party providers support Ashentrix operations, relevant providers may be evaluated based on the nature of the service, information involved and associated risks. Contractual terms, confidentiality, security requirements and access restrictions may be applied as appropriate.

Ashentrix's handling of personal information is described in its Privacy Policy. Where applicable, personal data processing will be performed in accordance with relevant contractual requirements and applicable data-protection law.

For India-related processing, Ashentrix will consider applicable requirements under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as they come into force and apply to the relevant processing. The notified Rules provide for phased commencement of provisions, so the applicable requirements may depend on the relevant date and processing context.

Ashentrix recognizes that clients in sectors such as Insurance, Banking, Finance, Healthcare, Telecom and other regulated industries may have specific security, privacy and regulatory requirements. Such requirements may be documented through the applicable contract, security questionnaire, SOW, DPA, SLA or client policy, subject to feasibility and mutual agreement.

For regulated or sensitive information, Ashentrix may implement additional contractual and operational controls appropriate to the engagement. Examples can include restricted access, enhanced monitoring, role-specific training, audit trails and documented handling procedures.

Any representation that Ashentrix is certified, formally compliant or independently attested against a particular framework should be verified against the Company's current certification or audit documentation before being relied upon.

Where Ashentrix provides web, application, analytics or technology services, security considerations may be incorporated into requirements, access controls, development practices, testing, deployment and maintenance as appropriate to the engagement.

Data retention is determined by business purpose, client instructions, contractual requirements and applicable law. When information is no longer required, Ashentrix may securely delete, return, anonymize or otherwise dispose of it in accordance with applicable requirements and contractual commitments.

Enterprise clients may request security questionnaires, documentation, assessments or other due-diligence information. Ashentrix will seek to provide appropriate information subject to confidentiality, security, contractual and operational considerations. Detailed technical information may require an appropriate confidentiality arrangement.

Where contractually agreed, Ashentrix may support reasonable client audits, assessments or compliance reviews relevant to the services provided. The scope, frequency, notice requirements, confidentiality and cost allocation for audits should be defined in the applicable agreement.

Ashentrix will represent certifications, attestations, regulatory approvals or formal compliance status only where such status is current and supported by appropriate documentation.

Website statements should not be interpreted as a representation that every Ashentrix service, client environment or process is certified or compliant with every listed framework. Client-specific compliance should be confirmed during contracting and due diligence.

Security is a shared responsibility. Ashentrix is responsible for controls within its agreed service and technology environment. Clients remain responsible for controls within their own systems, user accounts, configurations, data permissions, instructions and third-party environments unless otherwise agreed in writing.

If you believe you have identified a security vulnerability, unauthorized access, data exposure or other security concern relating to an Ashentrix Website or service, please report it promptly through the Company's official contact channel.

Do not publicly disclose suspected vulnerabilities before Ashentrix has had a reasonable opportunity to investigate and respond.

Ashentrix seeks to improve its security and compliance practices as its operations, technology, client requirements and applicable laws evolve. Security controls may be enhanced, replaced or updated based on risk assessments, incidents, audits, technology changes and business requirements.