Trust and security
Security, privacy and accessibility go in the foundation. Here's what that means in practice.
Genbays hosts client data in India by default and in the client's region on request, builds to WCAG 2.1 AA, and delivers software ready for India's DPDP Act. This page says what we do and how to report a problem.
Where your data lives
- India by default
- Mumbai region on the cloud providers we use. Forms on this site go to a Mumbai database.
- Your region on request
- Other regions are available for client builds on request. The choice is written into the DPA.
What we do on every build
- Access
- Named accounts, roles, and least privilege on every system we build and every system we touch. Access is logged.
- Secrets and keys
- Never in code. Managed by the hosting provider's secret store, rotated on staff change.
- Backups
- Daily, encrypted, in the same region as the data, restore-tested before go-live.
- Encryption
- In transit everywhere. At rest by default on every hosting provider we use.
- Dependencies
- Pinned, scanned, and updated on a schedule as part of the retainer.
- Staff
- Small team, direct accountability. Confidentiality agreements. Client data stays on client systems, not laptops.
- Incidents
- A written playbook. You hear from us first, within the windows in your DPA.
Compliance readiness
Readiness is a capability we build in, not a badge we've bought. Where a law needs a document, it's on the legal pages.
India · DPDP Act 2023
Consent records, purpose limitation, retention rules and Data Principal rights built into what we deliver.
Accessibility
WCAG 2.1 AA is a requirement on everything we build, per the RPwD Act 2016 and GIGW. Our statement for this site is on the legal pages.
Reporting a problem
- Security disclosure
- Found something? Email [email protected] with the subject Security disclosure. We reply within two business days and we don't take action against good-faith reports.
- Support commitments
- Response times by severity are agreed in the retainer and written into it. Documents for procurement: DPA, sub-processors, accessibility statement.
Questions people ask us
Can our data stay in our own cloud account?
Yes. We can build into an account you own, so the data never leaves your control and you can revoke our access on the day the contract ends.
Do you sign NDAs before the workflow review?
Yes, yours or ours, before we see anything.
Do you use AI tools on client data?
Not without written agreement on which tools, which data and where it's processed. By default, client data is not sent to third-party AI services.
Tell us what's slowing you down.
Forty-five minutes, no charge, no pushy follow-up. You'll talk to someone who builds software, not someone who sells it. You keep the workflow map either way.