Controls
Controls inside SAP and around it
Documented processes that can be audited, or taken in-house later.
Inside SAP
- SAP is the system of record
- We work within the roles your SAP team designs
- No one on our team holds sole authority to release payments
- We flag any access conflicts we find
Outside SAP
- Preparer and reviewer sign-off on every filing and schedule
- Named, logged access to government and bank portals
- Version-controlled working files
- Digital signature tokens held in secure custody under written authority from each director; every use approved and logged
Data protection
- Employee data processed on greytHR, our India payroll platform, under a data-processing agreement aligned to the DPDP Act, 2023
- We disclose greytHR's hosting location and security certifications in writing before signing
- Our own ISO/IEC 27001 (information security) certification is in progress; we will publish the scope and certificate once issued
- Third-party specialists disclosed before work begins and bound by the same confidentiality terms; we stay fully responsible
- No payroll data goes to a third party without your consent
Where your data lives
- This website and its enquiry forms are hosted on servers in India; enquiries are stored outside the public web folder.
- Client financial data stays in your SAP and in your government and bank portals; we work inside them under the roles your team grants.
- Working files are version-controlled and access is named, never shared.
- The payroll platform's hosting location and certifications are disclosed in writing before signing.
Data-processing terms (summary)
- We process personal data only on your documented instructions and for the services in scope.
- Everyone on the engagement is bound by confidentiality.
- Sub-processors and specialists are disclosed before work begins and bound by the same terms; we remain responsible.
- We help you respond to data-principal requests and notify you without undue delay of any personal-data breach.
- At the end of the engagement, data is returned or deleted as you instruct, subject to statutory retention.
The full data-processing agreement, aligned to the DPDP Act, 2023, forms part of the engagement agreement.
Security review questions? Send your vendor-risk questionnaire with the contact form and we will answer it in writing.
Need our security documentation?
We share platform details and data-processing terms before signing.