Security you can check.
Evidence your auditors can use.
Your data sits in a dedicated environment, in your region where available, under certified controls. Every action taken through the platform is recorded, so the proof your regulator asks for is already there.
Is our data safe with you? And will you make our audits harder?
Anubavam is certified to ISO/IEC 27001:2022 and ISO/IEC 27701:2019 by DNV. Each client runs in a dedicated environment, hosted in their region where available, with encryption, multi-factor sign-in and 48-hour breach notification. Every action taken through the platform is recorded, giving audit and compliance teams evidence without a separate exercise.
Most vendor reviews stop at the first question. The second one matters as much. A new system that protects data well but scatters approvals across email and spreadsheets still leaves your team rebuilding evidence before every audit.
This page answers both:
How we protect your data: certification, isolation, encryption, access, recovery and what happens in an incident.
How the platform helps you prove control: who did what, when, under which rule, with which approval.
What protects your data, and how you can verify it
| Control | What it means for you | How to verify |
|---|---|---|
| Certified management systems | Information security certified to ISO/IEC 27001:2022 and privacy to ISO/IEC 27701:2019, by DNV | Certificates in the security review pack |
| A dedicated environment | Your production environment is yours alone, not shared with other clients | Data Processing Addendum |
| Data in your region | Hosted on AWS or Oracle Cloud in the region you choose, where available. See Infrastructure and Hosting | Hosting schedule in your contract |
| Encryption | AES-256 for stored data; TLS 1.2 or higher for data in transit | Security policy summary |
| Controlled access | Role-based permissions, multi-factor authentication, and sign-in through your own identity provider. See Identity and Access | Tailored Proof Session |
| Logged support access | Our support staff reach your environment only through logged remote access. Your data stays in your region | Data Processing Addendum |
| Tested defences | An independent penetration test every year | Test summary, on request |
| AI kept in region | Generative AI is processed in your region where available, and your data is not used to train models offered to others | Data Processing Addendum |
Hosting regions and AI processing locations are confirmed per client and per component in your contract. Ask us for the details that apply to you.
The evidence is created as the work happens
Auditors and regulators ask the same questions: who approved this, under which policy, and was the rule the same last March? When work runs through Anubavam, the answers are recorded as part of the work, not rebuilt afterwards.
Illustrative
- A record of every action.Each step taken through the platform records who did it, when, what changed and which rule version applied. This covers people and AI agents alike.
- Separation of duties.The person who raises a request cannot approve it. The platform enforces this; it does not rely on people remembering.
- Rules as settings, with history.Approval limits and policy rules are settings, not code. Changing one needs approval, and every earlier version is kept, so you can show which rule applied to any past decision.
- Evidence on request.Export the full record for a case, a process or a period, ready for internal audit or a regulator.
What we hold, what we do not, and what is planned
Security reviews go faster when the vendor is clear. Here is where we stand.
ISO/IEC 27001:2022 (information security)Held. Certified by DNV
ISO/IEC 27701:2019 (privacy)Held. Certified by DNV
- SOC 2
- Not held. Type I planned for the first half of 2027 and Type II for the second half of 2027
- Data protection laws (such as GDPR and regional laws in the Gulf and Asia)
- These are laws, not certificates. Our Data Processing Addendum sets out how we support your obligations under them
- Sector regulations (for example central bank rules)
- You remain responsible for meeting your regulator’s rules. The platform gives you the controls and the evidence; we do not claim certification against them
If something goes wrong, here is what happens
| Situation | Our commitment |
|---|---|
| A service outage | 99.90% monthly uptime on our cloud. Severity 1 incidents are handled 24x7 |
| A data breach | We notify you within 48 hours of becoming aware of a confirmed breach of your data |
| A disaster at the hosting site | Recovery point objective 12 hours, recovery time objective 24 hours. Disaster recovery is tested every six months |
| A change of sub-processor | At least 30 days’ notice, with the right to object |
| The end of the contract | Your data is returned or deleted within 30 days, with written confirmation |
Note: Uptime and recovery commitments apply to services hosted in our cloud. When we run it in your cloud account or your data centre, they are agreed in your contract.
Everything your review needs, in one pack
The security review pack holds our ISO certificates, a summary of our security controls, the Data Processing Addendum, the sub-processor list, the SLA, and the latest penetration test and disaster recovery test summaries. Most vendor questionnaires can be answered from it.
The same controls already protect universities that run on Creatrix Campus, our higher education edition, built on the same platform.
- Report a vulnerability: itsecurity@anubavam.com
- Privacy and data protection: dpo@anubavam.com
- Security incidents: incidents@anubavam.com
- Certificates: compliance@anubavam.com
Questions from security and risk teams.
No. We hold ISO/IEC 27001:2022 and ISO/IEC 27701:2019, certified by DNV. A SOC 2 Type I report is planned for the first half of 2027 and Type II for the second half of 2027. Many reviews accept ISO 27001 in its place; we can help you check yours.
On AWS or Oracle Cloud, in the region you choose where available. The hosting region is written into your contract. See Infrastructure and Hosting for the regions we offer.
No. Each client’s production environment is dedicated to that client and isolated from others.
Only authorised support staff, through logged remote access, when needed to support you. Access is recorded, and your data stays in your hosting region.
No. Your data is not used to train AI models made available to others. Generative AI is processed in your region where available.
Within 48 hours of becoming aware of a confirmed breach of your data, as set out in our Data Processing Addendum.
Yes. Every action taken through the platform is recorded with who, what, when and which rule version applied. Separation of duties is enforced, and you can export the record for a case or a period.
It is returned in agreed formats or deleted within 30 days of the contract ending, with written confirmation.