How Definable keeps your data safe

The international standard for an information security management system: how a company finds the risks to the information it holds, treats them and keeps checking that the treatment works.

At Definable

• Our information security management system is certified by an independent certification body.
• Risks to the platform and to customer data are assessed and treated against the standard's 93 Annex A controls, recorded in our Statement of Applicability.
• A surveillance audit every year and a full recertification audit every three years keep the certificate current.

The international standard for an AI management system: how a company governs the AI systems it builds, provides or uses, from risk and impact assessment to data, transparency and human oversight.

At Definable

• Our AI management system is certified by an independent certification body, under an AI policy set by management.
• We assess the risks of our AI features and their impact on people before release, and again when they change.
• Human oversight is part of the product: approvals before the actions a customer chooses, a trace of every step and evals before an agent goes live.
• AI model providers are assessed before we use them, and those running on our own accounts may not train on customer data.

India's data protection law and the DPDP Rules, 2025: how the personal data of people in India must be collected, used, protected and erased, and the rights those people hold over it.

At Definable

• We are the Data Fiduciary for our own users' data, and a Data Processor for our customers' data, acting only on their instructions under our Data Processing Addendum.
• People can see, correct and erase their data, withdraw consent, nominate someone to act for them and raise a grievance.
• Our Grievance Officer acknowledges complaints within 24 hours and aims to resolve them within 15 days.
• We tell customers about a personal data breach within 48 hours, so they can meet their own 72-hour deadline.

An attestation by an independent CPA firm, under the AICPA's Trust Services Criteria, that a service organisation's controls for security, availability, processing integrity, confidentiality and privacy are designed well and work over time.

At Definable

• We're preparing for our SOC 2 audit. Most of the controls it examines already run under our ISO/IEC 27001 programme.
• Until the report is issued, we share our ISO certificates and answer security questionnaires on request.