Home › Trust & Compliance
Trust & ComplianceVIV.EKA holds production data — yield, cost, capacity, supplier terms and, for regulated manufacturers, protected health information. Everything your security team needs to assess us is on this page, including how to get the reports that are not.
Four frameworks, independently assessed. Scope, registrar and report details below.
Our information security management system is certified against the 2022 revision. The ISMS governs how we classify, protect, monitor and retire customer data across the platform and the infrastructure it runs on.
An independent auditor tested the design and the operating effectiveness of our controls across a defined observation window — which is what separates Type II from Type I. The full report is available under NDA.
We act as processor for customer personal data. Our Data Protection Addendum is published in full — Standard Contractual Clauses, the Annex 1 processing description, technical and organisational measures, and the sub-processor list — so your counsel can review it before the first call.
For medical device, pharmaceutical and life-sciences manufacturers whose production data touches protected health information, we operate the required administrative, physical and technical safeguards and will execute a Business Associate Agreement.
We publish our infrastructure and sub-processors rather than describing them in the abstract. Both are contractually binding through the Data Protection Addendum.
| Item | Detail |
|---|---|
| Deployment model | VIV.EKA is cloud-agnostic. It can run in your own cloud tenant, a region you nominate, on-premise, or in a CRSN-managed environment. The rows below describe the CRSN-managed option; where you host it yourself, your own controls and sub-processors apply |
| Infrastructure sub-processor (CRSN-managed) | Microsoft Corporation (India) Private Limited — hosting, databases, storage, backup, security, logging and Microsoft Entra ID authentication. Named in full in Annex 2 of the DPA |
| Data residency (CRSN-managed) | India. Transfers of EU-origin personal data are made under the 2021 Standard Contractual Clauses with a transfer impact assessment. Self-hosted deployments sit wherever you place them |
| Encryption | TLS in transit; encryption at rest on all customer data stores |
| Tenancy | Multi-tenant with logical isolation of customer data |
| Authentication | Multi-factor authentication or SSO required for all administrator and end-user access |
| Availability | Workloads deployed across multiple Availability Zones; disaster recovery tested regularly |
| Access control | Least privilege and need-to-know, with formal request, review and approval |
| Breach notification | Customer notified without undue delay on becoming aware of a personal data breach |
| Data return & deletion | Return or irreversible deletion at your election on termination |
Yes. Active prospects can receive the full SOC 2 Type II report once an NDA is in place. If your review is at an earlier stage, we can send a bridge letter and the ISO 27001 certificate without an NDA.
Yes, and most of the answers are already published here and in the DPA — sending your team these two links usually removes half the questionnaire. We complete CAIQ and SIG formats, and bespoke questionnaires on request.
That is your choice. VIV.EKA is cloud-agnostic — it can run in your own tenant, a region you nominate, on-premise, or in a CRSN-managed environment. If you self-host, your data never leaves your infrastructure. If CRSN manages it, data resides in India and we will not change the processing region without notifying you under the sub-processor provisions of the Data Protection Addendum.
Yes. We execute a Business Associate Agreement before any protected health information is processed. Contact the DPO to start that.
No. Under the Data Protection Addendum we process customer personal data solely on your documented instructions and for the purposes of providing the Services. We do not sell or share it, and we do not use it for any commercial purpose of our own.
Email connect.admin@crsn.in with the details. We acknowledge reports within two business days and will keep you updated through remediation.