Data security and compliance
The controls, certifications and handling practices your risk team will ask about.
Last updated 22 September 2026
Encryption and access
AES-256 at rest and TLS 1.3 in transit. Media is served only through signed URLs with short expiry and no public bucket access. Access is role-based with enforced two-factor authentication and complete audit logging.
Data residency
The primary region is AWS Mumbai, which satisfies DPDP localisation. Other regions are available where a client requires them and are named in the contract.
Workforce controls
Contributors are identity-verified before touching client data. Sensitive engagements run in NDA-only private pools with secure view mode, downloads disabled and IP allowlisting.
Redaction and de-identification
Spoken and written personally identifying content is removed in the pipeline before annotation, and the removal is verified as a separate pass. Faces and licence plates are redacted in imagery where the engagement requires it.
Standards
We operate an ISO 27001 aligned information security management system, comply with GDPR, CCPA and the DPDP Act 2023, and run a HIPAA-aligned workflow with BAAs for clinical engagements. SOC 2 Type II is in progress.
Retention and deletion
Retention periods are set per engagement and enforced by scheduled deletion jobs that include archives. A contributor consent withdrawal deletes the affected items, not just the account.
Questions about this policy? Write to support@karmyug.in.
Need this reviewed by your legal team?
We can provide a DPA, a BAA or a completed security questionnaire on request.