Security questions, answered clearly

Yes. AITC International is ISO 9001:2015 certified. This is a quality-management certification, not an information-security certification. Review the certificate for the legal entity, scope and validity relevant to your assessment.

No. ISO/IEC 27001 certification is in progress and is not currently held.

Yes, Standard Contractual Clauses (SCCs) are available on request, subject to review of the proposed transfer. The agreement needs the applicable European Commission-approved clauses, modules and completed annexes, rather than custom-written clauses presented as SCCs.

Yes. EU-region hosting is available on request.

When handling personal data on a client's instructions, AITC acts as a processor. A data processing agreement (DPA) is signed before that processing begins. The agreement should identify each party's role for the actual processing arrangement.

Our specified encryption standards are AES-256 at rest and TLS 1.2 or TLS 1.3 in transit.

In client-hosted environments, development and testing use anonymised or synthetic test data. Production access and non-production data handling should be reviewed separately for the engagement.

Yes. A current sub-processor list is available on request.

Yes. Multi-factor authentication (MFA) is part of our account-access controls. For a formal assessment, confirm enforcement coverage for the relevant systems, client-managed accounts, non-interactive service identities and any documented exceptions.

Access is granted according to the permissions needed for a person's role. Administrative or production access should be assessed separately from ordinary project access when defining the permissions required for your engagement.

AITC uses a joiner-mover-leaver process to manage access changes and revocation. Confirm which systems each party controls so the offboarding arrangements cover both AITC-managed access and access granted directly by your organisation.

Yes. Privileged and administrator access is reviewed regularly. The review cadence and supporting records can be confirmed during your assessment.

Yes. Enterprise single sign-on (SSO) and SAML support are available. Compatibility with your identity provider and the systems in scope needs to be confirmed for the engagement.

Our stated controls include MFA and least-privilege access. Those controls alone do not establish a complete Zero Trust architecture. Request architecture-specific evidence where your assessment requires confirmation of that model.

Credentials and secrets are handled through dedicated vault-based management rather than stored or shared in plaintext. The approved vault and access arrangements should be identified for the engagement.

Yes. Data Loss Prevention (DLP) controls are available where required by the client. Their scope must be agreed for the engagement; availability should not be interpreted as confirmation that the same DLP configuration is deployed across every device and service.

Microsoft Intune-based device management is available where required. Confirm which devices are enrolled and which policies apply to your engagement instead of assuming that a project-specific arrangement covers every company device.

Yes. Company devices are encrypted and company-managed. During your assessment, identify the devices permitted to access your systems and confirm the applicable access and management requirements.

Deployment options include AWS, Microsoft Azure, on-premise and hybrid environments. Infrastructure access uses the access controls applicable to the chosen platform; the AWS setup described in our questionnaire uses IAM users and roles. Confirm hosting ownership, region and access responsibilities for your deployment.

We use regular automated vulnerability scanning. Testing includes static and dynamic analysis, dependency checks and severity-based remediation. The testing scope and remediation commitments for your application need to be confirmed in the delivery and support arrangements.

Applications are penetration-tested before major releases, with findings remediated and retested. Confirm the testing scope, responsible tester and evidence available for your engagement. This does not imply a separate annual independent assessment of every company system.

Yes. Our secure software development lifecycle includes peer code review and separate development, staging and production environments. Security planning also includes threat modelling. The project's security requirements and release checks should be established before implementation.

Pipelines combine SAST, dependency and secrets scanning with automated tests and SonarQube quality gates. These checks help identify findings before release; they are not a guarantee that software contains no vulnerabilities. Confirm the enabled checks and acceptance criteria for your repository.

Recovery time objectives (RTOs) and recovery point objectives (RPOs) are agreed per system. RTO describes the targeted restoration time; RPO describes the targeted limit on data loss measured in time. Confirm both against the application’s backup and recovery design rather than treating one figure as universal.

Continuity measures include remote-work fallback, UPS and generator backup, and dual internet service providers. These measures support delivery operations. They should not be treated as the recovery plan or availability guarantee for a client's production application.

The notification timeline must be confirmed in the DPA and incident-response terms, alongside applicable legal obligations. Define the notification trigger, named contacts and update process before the engagement; a contract should not postpone a legally required notification.

Yes. A post-incident report is provided. The reporting scope and delivery timeline need to be agreed for the engagement rather than presented as one fixed deadline for every incident.

The stated retention baseline is 12 months for application and audit logs, and at least 90 days for security and access logs. Confirm the log categories, coverage and retention requirements for your environment, especially where the client controls the logging infrastructure.

Yes. Delivery work is tracked in Jira or Azure Boards. The project's chosen system should be identified so you know where to review work items and progress. Project tracking records are separate from application-security or access logs.

Yes. Employees are background-checked before being granted data access. The scope of those checks and any client-specific screening requirements should be confirmed during procurement.

Yes. Staff receive regular security awareness training. Request the training cadence and completion evidence needed for your vendor assessment.

Please request a dated statement covering both confirmed data breaches and security incidents for your required reporting period. A statement about breaches alone should not be interpreted as confirmation that no other security incidents occurred.

Commercial audit arrangements are discussed during contract review. The scope, notice and confidentiality terms need to be agreed, while any applicable statutory or data-processing audit rights must also be respected. Audit rights are not universally a matter of vendor discretion.

Liability and indemnification terms are determined in the contract for each engagement. Review the relevant provisions with the contracting parties' legal teams; this questionnaire does not establish a universal liability cap or indemnity.

Client data is returned or destroyed as specified in the contract and applicable data-processing obligations. The agreement should address the required return format, deletion confirmation, retained copies and any legally required retention.

An engagement-specific legal assessment is needed to confirm applicable export-control and sanctions requirements. Share your procurement requirements before onboarding. This page does not attest that a particular entity, service or transaction has passed sanctions screening.

No. AITC does not currently hold Professional Indemnity or Errors and Omissions (E&O) insurance. Raise any mandatory insurance requirement during procurement before proceeding with the engagement.

CCPA/CPRA compliance work is on our roadmap. That is not confirmation that a particular engagement meets every applicable requirement. Where California personal information is involved, the processing activities, contractual role and applicable obligations need to be assessed before a compliance statement is made.

No. AITC does not currently hold Cyber Essentials or Cyber Essentials Plus certification. Tell us during procurement when either certification is a mandatory supplier requirement.

Available options include logical separation using client-specific database tables or schemas, with dedicated AWS EC2 instances where required. The actual separation model and access restrictions need application-specific review. Cloud hosting or separate tables alone should not be treated as proof of effective tenant isolation.

No. AITC does not use client data to train or fine-tune AI or machine-learning models. Third-party tools require a separate review of their data-use terms and configuration; this answer should not be read as an automatic guarantee about every provider.

Third-party AI tools are used, and tool selection can be restricted to client requirements. AI-assisted code remains subject to review and quality checks. Client code and data stay within the agreed tooling environment. Confirm permitted tools and data handling before use.

Yes. Uptime commitments are defined for the services covered by the agreed service-level agreement (SLA). The target, measurement period, exclusions and remedies need to be confirmed for the engagement; this page does not apply one uptime percentage to every project.

AITC uses a formal change-management and approval process for production changes. The people authorised to approve a change and the applicable release conditions should be identified for your engagement.

Support priorities distinguish P1 production outages, P2 major issues, P3 minor issues and P4 cosmetic or low-priority issues. Acknowledgement times and coverage hours are set in the support agreement. An acknowledgement target is not the same as a resolution or service-restoration guarantee.

AITC International was founded in 2021. For vendor onboarding, request the registration details for the specific legal entity that will enter into your contract.

AITC has 100+ in-house staff, with approximately 70% in software engineering. Confirm the latest headcount and proposed project team during procurement; company-wide staffing is not the number of people allocated to an individual engagement.

AITC is headquartered in Bhaktapur, Nepal, with AITC FZCO in Dubai, UAE, and AITC Inc. in Texas, USA. Confirm the contracting entity, delivery locations and permitted data-access locations for your engagement.

Please specify whether you need employee retention, client retention or project-team continuity information, and the period to be assessed. These are different measures and should not be represented by one undefined retention percentage.

Financial summary information is available to qualifying clients under a non-disclosure agreement (NDA), on request. Share your due-diligence requirements so the scope of information can be discussed.