ZynoviqData processing, in one page.
Written for the person who has to approve the engagement. Most of our work needs no customer personal data at all, because every test case is synthetic. Where data is involved, this page sets out what we receive, where it is kept, for how long and under which contract.
Our role
- Synthetic first. Our test cases and datasets are written to contain no real personal data. A standard test needs no personal data from you.
- Data Processor for your data. Where we process personal data for you — for example in expert review of your live decisions — you decide why and how it is processed, and we act as your Data Processor under a written data processing agreement that meets the DPDP Act, 2023. We use that data only to perform the agreed service. It is never used to create test cases or datasets.
- Data Fiduciary for our own processing. For this website, enquiries and our professional network, we are the Data Fiduciary, as set out in our privacy notice.
What we receive
| Item | What it is | How it is handled |
|---|---|---|
| Access to a test environment | A way to send questions to your AI in a test or sandbox environment — never production | Scoped, time-bound and revocable; granted for the engagement and ending at its close; named individuals only |
| Endpoint credentials | An access key, if you issue one | Held in a managed secret store, used only for the agreed endpoint, never logged, deleted at the close; you can revoke it at any time |
| Your AI's outputs | The answers and actions your AI returns to our cases | Marked against the answer key and recorded in the audit trail |
| Code and account mapping | Your tax codes and account names mapped to ours | Names only — no balances or transactions |
| Real case data | Only for services such as expert review of live decisions | Under a data processing agreement, with reviewers limited by name and agreed retention |
We never access your production systems; your customers', employees' or suppliers' records; your ledgers, invoices or filings; or your AI's training data or model weights.
Where data is stored
Our systems run in an Indian cloud region, with encrypted storage and backups in a second Indian region. Answer keys are held in a separate, isolated store that only our marking service can read. We store personal data in India and transfer it outside India only where the DPDP Act and any Government restrictions permit, with safeguards appropriate to the data.
Security safeguards
Encryption in transit and at rest, least-privilege access controls, multi-factor authentication, logging and monitoring, vendor controls and staff confidentiality obligations. Every reviewer is checked against their profession's register, signs confidentiality and conflict-of-interest agreements, and sees only the cases assigned to them. Every case sent, answer received, judgment made and reviewer involved is recorded, and the record is available to you on request.
We do not hold SOC 2 or ISO 27001 certification. We are working towards ISO 27001 by December 2027. Our honest security position.
Security controls
Each control with its honest status today. "Available on request" means we provide it when you ask; "Planned" means it is not in place yet.
| Control | What it means | Status |
|---|---|---|
| Encryption | Data encrypted in transit and at rest | Implemented |
| India region | Systems run in an Indian cloud region, with encrypted backups in a second Indian region | Implemented |
| Isolated answer store | Answer keys held in a separate, encrypted store that only our marking service can read | Implemented |
| Access logging | Every access to the answer key is logged; security logs kept for at least one year | Implemented |
| Access control | Least-privilege access and multi-factor authentication; contributors see only the cases assigned to them | Implemented |
| Credential handling | Any access key you issue is held in a managed secret store, used only for the agreed endpoint, never logged, revocable by you at any time and deleted at the close | Implemented |
| Test-environment access | Scoped, time-bound and revocable; named individuals only; never production | Implemented |
| Reviewer vetting | Checked against their profession's register; signed confidentiality and conflict-of-interest agreements | Implemented |
| Leak tracing | Each customer receives a uniquely varied copy of a test pack, some with invented trap facts, so a leaked copy shows its source | Implemented |
| Retention and deletion | Access ends and keys are deleted at the close; data erased when its purpose ends and no law requires us to keep it | Implemented |
| Breach response | Notification to the Data Protection Board of India, affected individuals and CERT-In as the law requires | Implemented |
| Audit trail export | Every case sent, answer received, judgment made and reviewer involved, exported for you | Available on request |
| Data processing agreement | Under the DPDP Act, with reviewers limited by name and agreed retention, whenever we process personal data for you | Available on request |
| Certified deletion of licensed packs | Deletion by the licensee at the end of a licence, certified on request | Available on request |
| Security pack | Our answers to your security questionnaire, including where we do not yet hold a certification | Available on request |
| External penetration test | Before our first enterprise contract, and every year after that | Planned |
| ISO 27001 certification | Working towards certification by December 2027; no SOC 2 or ISO 27001 certification is held today | Planned |
Service providers (sub-processors)
We use service providers acting for us — cloud hosting, identity verification, payments, email, e-signature and analytics — under written contracts that require them to protect the data and use it only on our instructions. Engagement records are held in the cloud-hosted systems described above. We aim to use only India-hosted providers; any provider that stores personal data outside India will be listed in our privacy notice.
Retention and deletion
- At the close of an engagement, access to your test environment ends and any access key you issued is deleted.
- Real case data is kept only for the retention period agreed in the data processing agreement.
- Licensed test packs are deleted by the licensee at the end of the licence, with deletion certified on request.
- Client account and contract records are kept for the contract term plus 8 years, as the Companies Act, 2013 requires; security logs for at least one year.
- When the purpose ends and no law requires us to keep the data, we erase it and instruct our service providers to do the same.
Breaches
If a personal data breach occurs, we notify the Data Protection Board of India and affected individuals as the DPDP Act and Rules require, and report cyber-security incidents to CERT-In within the time its directions require. Where we act as your processor, individuals should direct requests about that data to you, and we assist you in responding.
The contract stack
| Document | What it covers |
|---|---|
| Non-disclosure agreement | Confidentiality of what is shared before and during scoping — our standard is a mutual NDA |
| Master services agreement (MSA) | The overall terms, liability and confidentiality |
| Order form or statement of work | The specific engagement: scope, deliverables, timeline and fees |
| Data processing agreement | Required whenever we process personal data for you |
| Licence | Use of test packs, datasets and reference packs — licensed, not sold. Licences |
| Contributor terms | The confidentiality and conduct obligations of the professionals who work on your cases. Member code of conduct |
Services are provided only under a signed MSA and order form; if a public summary conflicts with them, they prevail. Terms.
This summary does not replace the data processing agreement in your contract. Our privacy notice is currently a draft for legal review; the signed agreement governs.
Data processing — FAQ
Do you need personal data to test our AI?+
No. Our test cases are synthetic and written to contain no real personal data, so a standard test needs no personal data from you. Security and data handling.
Are you a data fiduciary or a data processor?+
Where we process personal data for you — for example in expert review of your live decisions — you are the Data Fiduciary and we act as your Data Processor under a data processing agreement. For our own website, enquiries and network, we are the Data Fiduciary. Privacy notice.
Where is data stored?+
In an Indian cloud region, with encrypted storage and backups in a second Indian region. Transfers outside India happen only where the DPDP Act permits them, with appropriate safeguards.
Do you hold SOC 2 or ISO 27001 certification?+
No. We say so plainly. We are working towards ISO 27001 by December 2027, and we complete an external penetration test before our first enterprise contract, and every year after that.
Can the Enterprise AI division see our data or results?+
Your engagement is delivered by our own teams: no one works on both our professional-intelligence business and the Enterprise AI division. We do not share personal data with the division for its own purposes, and we never test, grade or produce data for its products. Conflict-of-interest policy.