Information Security Policy

1. Our Commitment

Satark Technology Private Limited (“Satark AI”) is committed to protecting the confidentiality, integrity, and availability of information entrusted to us by our customers, partners, and employees. Security is foundational to our mission of turning security alerts into trusted business risk decisions.

2. Certifications and Attestations

• •ISO/IEC 27001:2022 — Information Security Management System, Certified (Certificate No. VW26050065)
• •ISO 9001:2015 — Quality Management System, Certified (Certificate No. VW26050066)
• •SOC 2 Type II — Attested

Certificates and reports are available to customers and prospects under NDA upon request.

3. Deployment Model and Shared Responsibility

The Satark AI Product is currently offered exclusively as an on-premise deployment — installed and operated entirely within each customer's own IT environment. We do not currently host a shared/multi-tenant SaaS version of the Product. Security of an on-premise deployment is a shared responsibility:

• •Customer responsibility: physical, network, and infrastructure security of the environment in which the Product is deployed, in line with the customer's own security program.
• •Satark AI responsibility: security of the Product software itself — secure development practices, vulnerability management, and timely security updates — consistent with our ISO/IEC 27001:2022-certified ISMS.

The Product's AI agents run on models self-hosted within the customer's own environment; no customer data is sent to external third-party AI/LLM providers for inference.

4. Our Security Program

Our Information Security Management System (ISMS) is governed by an internal Information Security Policy and supporting standards, covering:

• •Access Control — role-based access, least privilege, and periodic access reviews
• •Data Encryption — encryption of data in transit and at rest
• •Risk Management — regular risk assessments and treatment planning
• •Vendor & Third-Party Risk — due diligence and security review of sub-processors and vendors
• •Incident Response — a documented process for detecting, responding to, and reporting security incidents
• •Business Continuity & Disaster Recovery — plans to maintain service availability
• •Employee Security Awareness — mandatory onboarding and periodic security training
• •Change Management — controlled processes for changes to product releases
• •Logging & Monitoring — continuous monitoring of critical systems
• •Support Access Controls — any remote access to a customer's on-premise deployment for support/maintenance is authorized, logged, and time-boxed (see our Privacy Policy, Part B, Section 7)

5. Responsible AI & Governance

As an AI-driven platform, we are also building an AI governance program aligned to ISO/IEC 42001, covering human oversight of AI-driven risk decisions, AI risk management, and responsible data use for our self-hosted AI agents.

6. Data Protection

We process personal data in accordance with applicable law, including the Digital Personal Data Protection Act, 2023. See our Privacy Policy for details, including how Product/Platform data is handled under our on-premise deployment model.

7. Reporting a Security Concern

If you believe you have discovered a security vulnerability related to our Website or Product, please contact us at hello@getsatark.com. We appreciate responsible disclosure and will respond promptly.

8. Policy Review

This public summary is reviewed periodically and updated to reflect changes in our security program, deployment model, and certifications.

9. Contact Us