Security and compliance readiness for your vendor assessment

Security posture

• Certificates. Ask for the certificate copies and the scope statement, and confirm the numbers with the registrar before you rely on them. The scope statement decides which services the certificate covers.

• SOC 2 readiness. Support against the criteria your auditor names. We do not issue a SOC 2 report, and we do not hold one.

• PCI DSS readiness. Support for card-handling estates, including a documented cardholder-data boundary and the controls inside it. We hold no PCI DSS certificate.

• Identity and encryption. Least-privilege IAM, encryption in transit and at rest where the service supports it, and secrets handled under a runbook.

Security operations in the managed scope

• ✓Least-privilege IAM and access reviews.
• ✓Encryption in transit and at rest, where the service supports it.
• ✓Secrets handled under a runbook.
• ✓Logging that an auditor can follow.
• ✓Vulnerability scanning of in-scope hosts.
• ✓24x7 incident response for in-scope infrastructure, with incident records kept for audit.
• ✓Severity-based response times are written into the managed-services contract, not published on this page.

What you still own:

• Your identity provider and joiner-and-leaver process

• Application-layer penetration tests you commission

• Communications to your own customers after an incident, unless the contract says we speak for you

• Certification decisions you make with your auditor

Engineering on top of operations

Kubernetes, CI/CD pipelines, Infrastructure as Code and network design are scoped as project work, quoted separately, and then handed to the same operations team, so the platform that was built is the platform that is watched.

• ✓Containers. EKS, AKS or GKE, depending on the estate, with autoscaling and observability handed into the same on-call.
• ✓CI/CD and IaC. Pipelines plus Terraform or CloudFormation, so environments are reproducible rather than built by hand.
• ✓Network and edge. VPC design, DNS, certificates, load balancers, and web application firewall rules.

Where your data would sit

Bangladesh has no hyperscaler region. Our current working regions are:

• ✓AWS: Mumbai (ap-south-1) and Singapore (ap-southeast-1)
• ✓Google Cloud: asia-south1 (Mumbai), asia-south2 (Delhi) and asia-southeast1 (Singapore)
• ✓Microsoft Azure: Central India (Pune), South India (Chennai), West India (Mumbai) and Southeast Asia (Singapore)

Region is a contract decision, and it goes into the design before the build starts. Where personal data is involved, data-protection rules apply as applicable in your jurisdiction and shape where data may live and how transfers are documented. Where a transfer needs a mechanism, we document it in the contract instead of assuming it. Your privacy counsel decides which mechanism applies.

We make no claim under any sector-specific regime. Whether one applies to your data is for you and your counsel.

What this page does not claim

• ✓SOC 2 or PCI DSS certificates
• ✓Compliance with any regulation on your behalf
• ✓Government security clearance
• ✓Published SLA minutes, or incident response times as public minute counts