This page is written to stand alone. Forward it to your IT security team, your legal counsel or your client's compliance officer, and it should answer "is this safe to put our risk data in" without the rest of the site.
Reports are available to customers and prospects under NDA through the request form below.
Security, availability and confidentiality trust services criteria. [Report period and auditor]
Request the report →Information security management system. [Certificate number, scope and expiry]
Request the certificate →Alignment with regulator cloud and outsourcing guidance for India and the GCC. [List applicable assessments, e.g. RBI outsourcing, CBUAE cloud guidance, UAE IAS]
Request the mapping →Customer data is hosted in [region, e.g. UAE (Dubai) and India (Mumbai)]. The region is chosen at provisioning and does not change without your written instruction.
Residency options for customers with regulatory or contractual requirements. Backups stay within the same region.
TLS 1.2 or higher in transit; AES-256 at rest for databases, file storage and backups. Keys managed through the cloud provider's key management service.
Each customer is a separate tenant with logically isolated data. Consulting firms' client workspaces are isolated from each other within the firm's account.
Daily encrypted backups with [retention period] retention; point-in-time restore tested [frequency].
Export your documents, registers and histories at any time in standard formats. On termination, data is deleted within [period] and confirmed in writing.
Blueprint+ is built on role-based access from the document down to the workflow step. The audit log that compliance teams use for their own evidence is the same log that records access.
Service level objective of [99.9%] monthly availability, with service credits defined in the enterprise agreement. Live and historical status at the status page.
Annual third-party penetration testing, continuous dependency scanning, and a defined patch window by severity. [Last test date].
A documented incident response process with customer notification within [period] of a confirmed incident affecting your data.
Multi-zone deployment within the region and a tested disaster-recovery plan with defined RPO and RTO.
Code review, automated testing and security checks on every change; separation of production from development environments.
Magpie AI processes your content to produce drafts and suggestions for you. Your data is not used to train models shared with other customers. The co-pilot can be disabled per tenant.
Our Data Processing Agreement is available to every customer, with the current sub-processor list. Changes are notified [notice period] in advance. Read the DPA and the full list →
The SOC 2 report, ISO certificate, penetration-test summary, security whitepaper and completed questionnaires (SIG, CAIQ) are shared under NDA. Tell us who you are and what you need.