Headx is certified under ISO/IEC 27001:2022 (information security management) and SOC 2 Type I (trust services criteria). The certificate and audit report are available from sales on request.
1 Data protection
Encryption in transit
All traffic between the Headx agent, dashboard, and backend uses TLS 1.3 with modern cipher suites. Older TLS versions are disabled. HSTS is enforced with a 1-year max-age on all customer-facing endpoints.
Encryption at rest
All data stored by Headx Cloud is encrypted at rest using AES-256. Database volumes are encrypted with AWS KMS-managed keys. Object storage (screenshots, recordings) is encrypted server-side. On-Premise installations use the same cipher; key management is delegated to the customer's chosen KMS or OS-level key store.
Key management
Cloud customer-keys are stored in AWS KMS with annual rotation. Customer-managed key (CMK / BYOK) support is available on On-Premise. JWT secrets, database credentials, and third-party API tokens are stored in a dedicated secrets manager — never in source control or environment variables exposed in logs.
2 Data residency
Cloud: All Headx Cloud data is hosted in AWS Mumbai (ap-south-1). No replication outside India. Backup snapshots also reside in ap-south-1. We do not use US, EU, or Singapore regions for production Cloud workloads.
On-Premise: Data resides exclusively on customer infrastructure. Headx engineers can access On-Premise systems only via customer-initiated screen-share sessions for support; we hold no copy of customer data.
This satisfies the data-localisation requirements of the RBI Master Direction on IT Outsourcing, IRDAI Information and Cyber Security Guidelines, and the SEBI Cybersecurity Framework.
3 Access controls
Customer-side
Role-based access control with five default roles (super admin, admin, manager, auditor, viewer) and the ability to define custom roles with granular permissions. Session timeouts configurable per company. IP allowlist available for the admin panel. Multi-factor authentication is on the roadmap and is not available today.
Headx-side
Headx employees have no default access to customer data. Privileged-access workflows require:
- Explicit customer ticket or approval
- SSO + hardware-key MFA
- Time-boxed access (auto-revoked after the support session)
- Full session recording of any access action
- Audit-log entry shared with the customer afterwards
Background-verified employees only. Quarterly access reviews for all internal systems.
4 Agent (endpoint) security
The Windows agent is:
- Code-signed with an Extended Validation certificate
- Submitted to all major AV vendors for proactive false-positive prevention
- Pinned-certificate communication to prevent MITM
- Runs as a service under a dedicated low-privilege account where the OS allows
- Reverse-tampering resistant — uninstall requires admin privilege and is audit-logged
- Supports off-line buffering with encrypted queue if network is unavailable
See Security Architecture for the full technical breakdown.
5 Compliance frameworks
India statutory
| Framework | Status | Notes |
|---|---|---|
| IT Act 2000 (Section 43A) + 2008 amendment | Aligned | Reasonable security practices implemented |
| IT (Reasonable Security Practices) Rules 2011 | Aligned | Consent, notice, retention, breach reporting |
| DPDP Act 2023 | Aligned | Granular consent flags ship today. Full status |
Sector-specific
| Framework | Sector | Status |
|---|---|---|
| RBI Master Direction on IT Outsourcing (Apr 2023) | Banks / NBFC | Aligned |
| RBI Cyber Security Framework for Banks (Jun 2016) | Banks | Aligned |
| IRDAI Information & Cyber Security Guidelines (2017) | Insurance | Aligned |
| SEBI Cybersecurity & Cyber Resilience Framework (Aug 2022) | Capital markets | Aligned |
| NDHM / DISHA (draft) | Healthcare | Incorporated |
International certifications
| Framework | Status | Scope |
|---|---|---|
| ISO/IEC 27001:2022 | Certified | Information security management system. Certificate details |
| SOC 2 Type I | Certified | Trust services criteria audit |
| GDPR (Article 28 DPA) | Available | For EU-HQ customers with Indian operations |
6 Reporting a vulnerability
If you discover a security vulnerability in Headx, please report it to info@headx.in with:
- A description of the issue and reproduction steps
- Affected endpoint or page
- Severity assessment (your view)
- Any proof-of-concept code (please do not include real customer data)
Our SLA
| Stage | Timeline |
|---|---|
| Acknowledgement | Within 4 hours (24x7) |
| Confirmation | Within 48 hours |
| Patch (high severity) | Within 14 days |
| Public credit | On request, after fix is deployed |
7 Incident response and notification
Headx maintains a documented incident response runbook with the following commitments:
- Detection — 24x7 monitoring with alerting on anomalous infrastructure activity
- Containment — within 2 hours of confirmed incident
- Customer notification — affected customers notified within 72 hours of confirmation (DPDP Act 2023 alignment)
- Public disclosure — within 30 days of resolution if customer data was affected
- Post-mortem — published to affected customers within 30 days of resolution
8 Sub-processors and data flows
For Cloud customers, the following sub-processors handle data on our behalf:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Compute, storage, database | Mumbai, India (ap-south-1) |
| Cloudflare | CDN, DDoS protection, WAF | Global edge (data does not leave India for processing) |
| Cashfree Payments | Payment processing | India |
| Razorpay | Payment processing (alternative) | India |
| Postmark / Resend | Transactional email | US (no customer activity data shared) |
On-Premise customers have zero sub-processors — all data flows are inside the customer's own infrastructure.
9 Audits and assurance
Available to customers under NDA, typically within 24 hours of request:
- Penetration test summary (latest: Q1 2026, conducted by external firm)
- Security questionnaire responses (SIG, CAIQ, customer-specific)
- Data Processing Agreement (DPA) signed by our authorised signatory
- Sub-processor list with annual review
- Incident response playbook (redacted)
Related documents
- Security Architecture — full technical security documentation
- DPDP Act 2023 Status — granular compliance posture
- ISO 27001 Certification — certificate & scope
- Employee Monitoring Laws in India — legal framework guide
- Privacy Policy — how we handle personal data
Request via info@headx.in or info@headx.in.
Need detailed audit evidence or a signed DPA?
The full Statement of Applicability, latest penetration-test summary, sub-processor register with annual review records, and pre-filled CAIQ / SIG questionnaires are available under NDA — typically within 24 hours (IST business days).