Security & trust
Security answers, before you ask.
How Upcore handles your code and data, which AI providers process it, and the contracts available before any engagement starts. Our information security management is certified to ISO 27001:2022.
Security questions? We respond within 24 hours
- Your environmentRepositories, CI/CD and business systems. Builds run here.Stays yours
- OAuth access, scoped to the branches in your SOW
- Your Upcore teamNamed people only. Access is revoked at the end of the engagement, or whenever you ask.Named
- Prompts sent to an enterprise model API
- Model providerCovered by a data processing agreement, with no training on your data. Named in your SOW before you sign.No training
- Code copied to Upcore servers
- No
- Training on your data
- No
- Provider named
- Before you sign
ISO 27001
ISO 9001
- Clutch 5.0★ (opens in a new tab)
- Claude Certified Architects
Quick reference
Six questions from every CISO.
Short answers first. Open any question for the detail.
YesIs Upcore ISO 27001 certified?
Yes. Upcore Technologies Pvt. Ltd. holds ISO 27001:2022 certification at organization level, covering information security management across all delivery functions.
Only with your permissionDoes our code leave our environment?
Work happens in your repositories through OAuth-scoped access. No code is copied to Upcore servers, and snippets shared for analysis are not kept after the session.
Named in your contractWhich AI providers process our data?
They are named in your Statement of Work and Data Processing Agreement before the engagement starts. We use enterprise-tier API agreements, and no provider we use trains on customer data.
YesCan you sign a Business Associate Agreement?
Yes, for any engagement where protected health information may be in scope. Raise it on the discovery call and it is added to your contract package.
YesCan we use our own model, on-premise or in a private cloud?
Yes. For air-gapped requirements we deploy open-weight models on your infrastructure. It adds about two weeks to the initial deployment.
On requestWhat is your compliance and audit posture?
We hold ISO 27001, ISO 9001 and a CMMI Level 3 appraisal. Scope, data handling and subprocessors are covered in a Security Review Pack, available on request during procurement from gaurav@upcoretechnologies.com. Our governance work also produces the AI evidence clients need for their own SOC 2, HIPAA and EU AI Act audits.
Certifications · certificates are shared with enterprise clients during procurement
- ISO 27001:2022
Information security management, covering client data handling, access control and incident response.
Certified, active - ISO 9001:2015
Quality management: planning, monitoring and continual improvement across client delivery.
Certified, active - CMMI Level 3
Delivery processes are documented, standardized and applied the same way on every engagement.
Appraised, active
Data handling
Where your code and data go.
The specifics your procurement team will ask for. Need it as a formal document? Ask for our Data Processing Appendix.
- Repository access
OAuth with the minimum permissions: read access to the branches in your SOW. Write access only if you opt in to automated pull-request comments. Revoked at the end of the engagement or whenever you ask.
- Code retention
No code is copied to Upcore systems. Snippets shared for AI-assisted review are processed in context and not stored after the session. Audit-log entries are kept for the engagement and handed to you when it ends.
- Data residency
Analysis uses the model provider’s regional endpoint nearest your data. EU clients get EU-region endpoints by default; US-only residency is configured at onboarding. The specifics are written into your DPA.
- Access controls
Only the named people on your engagement can reach your environment, unless you approve someone else. Credentials are held in an ISO 27001-compliant credential management system.
- Subprocessors
The full list, including model providers, credential management and communication tools, is in your DPA. New subprocessors come with 30 days’ notice and the right to object.
- Incident notification
If a security incident affects your data, we notify you within 72 hours of becoming aware, in line with ISO 27001 incident management and GDPR Article 33.
AI in our delivery
Which AI sees your code, and on what terms.
We use enterprise-tier model APIs for assisted work, the same way your engineers use Copilot or Cursor, but under documented access controls and data processing agreements. Clients who cannot send code to any external API can run open-weight models on their own infrastructure.
- Model providers train on your data
- No
- Data processing agreement
- Yes, with every MSA
- Provider named in your SOW
- Yes, before you sign
- On-premise model option
- Available
- Code sent to Upcore servers
- No
- EU-region endpoints for EU clients
- Default
- Prompt audit logging
- Included
Compliance support
Audit evidence, created as the work happens.
We don’t give legal or audit opinions. Our governance work generates the records and audit trail that show adherence to these frameworks.
High-risk classification and documentation
We map your AI systems to the Act’s high-risk categories, produce the conformity documentation and keep an AI system register aligned to Annex III. General obligations apply from 2 August 2026; high-risk obligations are due 2 December 2027.
AI-written code near protected health information
Reviews make sure AI-written code doesn’t open access-control or encryption gaps under §164.312 in systems that touch PHI. A Business Associate Agreement is available.
Audit trails for AI in financial systems
For public companies, our governance work produces the AI code audit trail your external auditors need under PCAOB AS 2201, so gaps are closed before the audit cycle.
AI processing and data flows
AI-written code that processes personal data is reviewed for DPIA triggers, data minimization and purpose limitation. EU client data is processed under Standard Contractual Clauses.
AI management systems
We align your AI governance with the international standard for AI management systems, useful if you are preparing for formal certification.
Code-level controls
AI code reviews check against the OWASP Top 10 for LLM applications, including prompt injection, insecure output handling and supply-chain risks, with controls recorded per pull request.
Contracts & protections
Everything legal needs, before you sign.
Every document is shared at the discovery-call stage, before any engagement starts.
- Master Services AgreementLiability, indemnification, IP ownership, confidentiality and termination rights. Your legal team can redline it.Standard contract
- Data Processing AgreementEvery data flow between your environment and ours: subprocessors, retention, deletion and breach notification. Required for every engagement.Included with the MSA
- Business Associate AgreementOur obligations as a Business Associate under HIPAA, with the safeguards your compliance team requires.On request, healthcare
- Mutual NDACovers your code and business information, and our methods. Signed before any call where sensitive details are shared.Before the discovery call
- Standard Contractual ClausesThe EU-approved mechanism for transferring personal data to our India-based team.Standard for EU clients
- Security Review PackISO 27001 certificate, CMMI attestation, subprocessor list and security questionnaire responses.On request, under NDA
Entity & jurisdiction
Buying from an Indian company? Your questions, answered.
GDPR: India is not an EU adequacy country. How does data transfer work?
EU personal data transferred to Upcore is governed by Standard Contractual Clauses, the European Commission’s approved mechanism for transfers to non-adequacy countries. Our DPA, included with every MSA, specifies the SCC module, subprocessor list and breach-notification timeline. No EU personal data is processed outside the executed SCCs.
HIPAA: can an Indian private limited company sign a Business Associate Agreement?
Yes. HIPAA’s Business Associate requirements depend on the data handled, not where the vendor is incorporated. If PHI may be in scope, we execute a BAA that meets the 45 CFR §164.308–314 safeguard requirements, reviewed by your compliance team before any engagement starts.
SOX: how does an Indian vendor fit into a SOX-scoped audit chain?
SOX Section 404 requires controls over financial reporting to be documented and tested, including third-party vendors with access to financial data or systems. Upcore is treated as a third-party vendor under your vendor-management controls, and our governance work delivers documentation (control inventories, change logs and risk assessments) your internal audit team can present to your external auditor.
EU AI Act: does the Act apply to an Indian provider serving EU clients?
Yes. Under the Act’s extraterritorial scope (Article 2), providers placing AI systems on the EU market, or whose outputs are used in the EU, are covered wherever they are established. Our governance work includes EU AI Act mapping: risk classification, transparency obligations and conformity documentation.
Bring your security questionnaire to the first call.
Book a 45-minute discovery call and we’ll answer your CISO’s questions before you commit to anything. Or request the Security Review Pack first.
Security questions? Email gaurav@upcoretechnologies.com. We respond within 24 hours.