Book a Demo
Trust Center

A security company should show its work.

These pages document how the Offload Platform handles your data — in enough depth for your security review, with the whitepapers to back it.

Source code is never stored

Repositories are cloned into ephemeral, scan-scoped workspaces and deleted on completion — success or failure. Only findings and small per-finding excerpts (±6 lines) are retained.

Credentials encrypted at rest

Git tokens, cloud credentials, cluster configs, and API keys are encrypted with authenticated encryption (Fernet: AES-128-CBC + HMAC), decrypted in memory only at the moment of use.

Encrypted in transit

All traffic to the platform — browser, API, CLI and CI integrations — is served over TLS. Outbound connections to your cloud providers, registries and Git hosts use their TLS endpoints; nothing is fetched in the clear.

Strict tenant isolation

Every record is scoped to the owning team and enforced on every read and write path, backed by database-level indexes.

Retention and deletion

Configurable retention windows on scan data; per-scan hard deletes; a tenant-offboarding cascade that removes all customer data including stored credentials.

No AI training on your data

Optional AI features use your own model-provider API keys, send minimal context, and never train on your data. Customer-specific AI responses are never cached across tenants.

On-premises deployment

The entire platform can run inside your environment — findings, excerpts, evidence, and credentials never leave your network.

We scan ourselves

Every push to the platform's own repositories runs the Offload scanner in CI — secrets, SBOM, dependency (SCA) and IaC checks — alongside automated dependency updates. The scanner you buy is the one we ship under.

Independently assessed

The platform has undergone a vulnerability assessment by an independent third party. The assessment summary is available to customers under NDA.

Memberships & certifications

Independently recognized

Member

DSCI Corporate Member

Data Security Council of India — the nasscom-established industry body for cybersecurity and privacy

Compliance roadmap

Where we are on our own compliance

We hold ourselves to the standards we help customers meet. This is our current, honest status — in progress and self-attested where noted, not third-party certification yet. We'll update it as milestones land.

In progress

ISO/IEC 27001:2022

Information security management system

ISMS implemented; certification audit to follow.

In progress

SOC 2 Type II

Trust Services Criteria — Security

Controls implementation and audit preparation under way.

Aligned internally

DPDP Act, 2023 (India)

Digital Personal Data Protection

Our own practices are aligned to DPDP — we run the DPDP module we build.

Documents

For your security review