Security Overview | Supersei

Security Overview

How we protect your data

Our Commitment to Security

At Supersei Technologies Pvt. Ltd., security is not an afterthought — it is a foundational principle embedded in every layer of our platform, processes, and culture. We build and operate our AI SaaS platform with the understanding that our customers trust us with sensitive business data and workflows, and we take that responsibility seriously.

This page describes the technical and organisational controls we maintain to protect the confidentiality, integrity, and availability of customer data. We continuously review and improve these controls as the threat landscape evolves.

Infrastructure Security

Our platform is hosted entirely on Amazon Web Services (AWS), giving us access to enterprise-grade physical security, redundancy, and compliance certifications at the infrastructure level.

  • Virtual Private Cloud (VPC) isolation: All production workloads run inside dedicated VPCs with strict network segmentation. Public-facing services are separated from internal services via private subnets, security groups, and network access control lists (NACLs).
  • DDoS protection: We leverage AWS Shield Standard across all endpoints and AWS Shield Advanced for critical services, providing automatic detection and mitigation of volumetric and application-layer DDoS attacks.
  • Web Application Firewall (WAF): AWS WAF is deployed in front of all public-facing APIs and web properties. Rules are regularly updated to block common attack patterns including SQL injection, cross-site scripting, and malicious bot traffic.
  • Hardened compute: Server images are built from minimal, regularly patched base images. Unused ports, services, and OS components are disabled by default. Host-based intrusion detection is active on all production instances.
  • Availability zones: Production services are distributed across multiple AWS Availability Zones to eliminate single points of failure and ensure high availability.

Data Encryption

All customer data is protected by strong encryption both while in transit across networks and while at rest in our storage systems.

In Transit

  • All communication between clients and Supersei services is enforced over TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled platform-wide.
  • We use strong cipher suites with forward secrecy (ECDHE) and reject weak or deprecated algorithms.
  • Internal service-to-service communication within our infrastructure is also encrypted in transit via mutual TLS where applicable.

At Rest

  • All data stored on disk — including databases, object storage (Amazon S3), and backup archives — is encrypted using AES-256.
  • AWS Key Management Service (KMS) is used to manage encryption keys. Keys are rotated automatically on a defined schedule.
  • Customer data is logically isolated at the storage layer to prevent cross-tenant access, even in shared infrastructure components.

Key Management

  • Encryption keys are managed centrally through AWS KMS with strict access policies. No individual engineer has direct access to plaintext customer data encryption keys in production.
  • Key usage is logged and auditable. Access to key management functions requires elevated permissions and is subject to approval workflows.

Access Controls

We apply strict access control policies across our platform and internal systems to ensure that the right people have the right access — and nothing more.

  • Role-based access control (RBAC): Customer-facing features expose granular roles (Owner, Admin, Member, Viewer) so organisations can enforce access policies appropriate to their internal structure. Internally, employee access to systems and data is also governed by roles aligned to job function.
  • Multi-factor authentication (MFA): MFA is enforced for all Supersei employee accounts on internal systems, cloud provider consoles, and production tooling. Customers are strongly encouraged — and for certain plan tiers, required — to enable MFA on their Supersei accounts.
  • Principle of least privilege: Access is granted on a need-to-know, need-to-do basis. Employees are provisioned with the minimum permissions required to perform their role. Permissions are reviewed on a periodic basis and revoked promptly when no longer required.
  • Privileged access management: Access to production environments is gated behind additional approval steps and is time-limited. All privileged sessions are logged.
  • Audit logging: All administrative actions, authentication events, and data access operations are recorded in tamper-evident audit logs. Logs are retained for a minimum of 12 months and are available to enterprise customers on request for their own compliance needs.
  • Offboarding: Access for departing employees is revoked within one business day. All credentials, tokens, and SSH keys associated with the departing individual are rotated.

Application Security

Security is integrated into our software development lifecycle (SDLC) from design through deployment.

  • OWASP Top 10: Our engineers are trained on and our code review process actively checks for the OWASP Top 10 web application security risks, including injection attacks, broken authentication, insecure direct object references, security misconfiguration, and more.
  • Secure code review: All code changes go through mandatory peer review before merging. Security-sensitive changes (authentication, authorisation, data handling, cryptography) require review from a senior engineer with security expertise.
  • Static analysis: Automated static application security testing (SAST) tools run on every pull request to detect common vulnerability patterns before code reaches production.
  • Dependency scanning: We use automated software composition analysis (SCA) tools to continuously monitor third-party dependencies for known vulnerabilities. Vulnerable dependencies are patched or replaced promptly according to severity.
  • Penetration testing: Supersei engages qualified independent security researchers and third-party firms to conduct penetration tests against our platform on a regular basis. Findings are triaged, tracked, and remediated according to a risk-based priority schedule.
  • Security headers and hardening: Our web application enforces strict HTTP security headers (Content Security Policy, HSTS, X-Frame-Options, Referrer-Policy, and others) to reduce exposure to client-side attacks.

AI and Data Processing Security

Supersei is an AI-powered platform, and we apply dedicated controls to ensure that AI processing does not introduce risks to customer data or platform integrity.

  • Model isolation: AI model inference is performed in isolated compute environments. Each inference request is sandboxed and does not carry state or context from other customers' sessions.
  • No cross-tenant data leakage: Customer data used in AI processing — including prompts, context, and outputs — is strictly scoped to the originating tenant. Our architecture prevents any mechanism by which one customer's data could surface in another customer's AI responses.
  • Prompt injection protections: We implement input validation, output sanitisation, and structural safeguards to detect and neutralise prompt injection attempts — both direct attacks from end users and indirect injection via untrusted external content ingested by the platform.
  • No training on customer data: We do not use customer-submitted data to train or fine-tune AI models without explicit, documented opt-in consent from the customer.
  • Output monitoring: AI-generated outputs are subject to safety filters and anomaly detection to prevent the platform from being used to generate harmful, illegal, or policy-violating content.

Incident Response

We maintain a documented, tested Incident Response Plan (IRP) to ensure that security events are identified, contained, and resolved quickly and systematically.

  • 24/7 monitoring: Our infrastructure and application layers are monitored continuously using a combination of AWS-native tooling (CloudWatch, GuardDuty, Security Hub) and third-party SIEM solutions. Alerts are routed to on-call engineers around the clock.
  • Incident classification: Security events are classified by severity (Critical, High, Medium, Low) with defined escalation paths, response time targets, and communication protocols for each level.
  • Containment and remediation: Upon detection, our incident response team follows a structured playbook covering containment, evidence preservation, root cause analysis, remediation, and post-incident review.
  • Breach notification: In the event of a confirmed personal data breach, Supersei Technologies Pvt. Ltd. will notify affected customers and relevant supervisory authorities within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33 obligations and applicable Indian data protection regulations.
  • Post-incident reviews: All significant security incidents are followed by a blameless post-mortem to identify root causes and prevent recurrence. Findings are tracked and resolved with owners and deadlines assigned.

Business Continuity

We design our platform and operational processes to withstand disruptions and recover quickly when unexpected events occur.

  • Automated backups: Customer data is backed up automatically on a daily basis. Backups are encrypted at rest, stored in geographically separate AWS regions, and tested for restorability on a regular cadence.
  • Disaster recovery: We maintain a documented Disaster Recovery Plan (DRP) covering scenarios including regional AWS outages, data corruption events, and catastrophic infrastructure failures. DR runbooks are reviewed and updated at least annually.
  • Recovery Time Objective (RTO): Our target RTO for critical platform services following a major incident is 4 hours.
  • Recovery Point Objective (RPO): Our target RPO is 1 hour, meaning in a worst-case data loss scenario, no more than 1 hour of customer data would be unrecoverable.
  • Redundancy: Core services are deployed in active-active or active-passive configurations across multiple Availability Zones. Database clusters use multi-AZ replication with automatic failover.

Compliance

Supersei Technologies Pvt. Ltd. is committed to aligning with recognised security standards and data protection regulations.

  • GDPR: We comply with the General Data Protection Regulation (EU) 2016/679 in our handling of personal data of European residents. Our Data Processing Agreement (DPA) is available to customers upon request. We support data subject rights including access, rectification, erasure, and portability.
  • SOC 2 Type II (in progress): We are currently undergoing a SOC 2 Type II audit against the Trust Services Criteria for Security, Availability, and Confidentiality. We expect to complete this audit and provide the report to enterprise customers upon request.
  • ISO 27001 (planned): Certification against ISO/IEC 27001:2022 is on our security roadmap. We have structured our Information Security Management System (ISMS) in alignment with ISO 27001 controls in preparation for formal certification.
  • DPDP Act (India): We monitor and align our data handling practices with India's Digital Personal Data Protection Act, 2023 as implementing rules are issued.

Copies of applicable compliance reports and certifications are available to enterprise customers under NDA. Please contact security@supersei.ai to request documentation.

Vendor Security

Supersei Technologies Pvt. Ltd. engages a limited number of third-party vendors and sub-processors to deliver our platform services. We hold our vendors to the same security standards we apply to ourselves.

  • Third-party risk assessment: Before onboarding any vendor that will process customer data or have access to our production environment, we conduct a security assessment covering their controls, certifications, data handling practices, and incident response capabilities.
  • Contractual obligations: All vendors who process personal data execute a Data Processing Agreement (DPA) with us. Security and data protection requirements are included in all vendor contracts.
  • Periodic reviews: Vendor security posture is reviewed periodically and whenever there is a material change to the vendor's services or our use of them.
  • Minimal data sharing: We share only the minimum data necessary with each vendor to perform the contracted service. We do not permit vendors to use customer data for their own purposes beyond service delivery.

Employee Security

Our people are a critical part of our security posture. We invest in hiring, training, and processes that make our team a security asset rather than a liability.

  • Background checks: All new employees undergo background verification prior to joining Supersei, including identity verification, education and employment history checks, and criminal record checks as permitted by applicable law.
  • Security awareness training: All employees complete mandatory security awareness training at onboarding and on an annual basis thereafter. Training covers phishing, social engineering, secure coding practices, data handling, and incident reporting obligations.
  • Phishing simulations: We run periodic simulated phishing exercises to reinforce employee awareness and identify areas for additional training.
  • Non-disclosure agreements (NDA): All employees, contractors, and third parties with access to confidential information sign NDAs prior to access being granted. Confidentiality obligations survive the end of the employment or engagement relationship.
  • Acceptable use policy: Employees are bound by an Acceptable Use Policy covering the handling of company and customer data, use of approved devices and software, and obligations around remote working security.

Responsible Disclosure

Supersei Technologies Pvt. Ltd. welcomes reports from security researchers and the broader community who identify potential vulnerabilities in our platform. We are committed to working collaboratively with researchers to understand and address valid findings promptly.

We ask that researchers act in good faith, avoid accessing or modifying customer data, and refrain from disruptive testing. In return, we commit to acknowledging reports promptly, keeping researchers informed of progress, and not pursuing legal action against researchers who comply with our responsible disclosure guidelines.

Please review our full Responsible Disclosure Policy before submitting a report.

Contact

For security concerns, vulnerability reports, compliance documentation requests, or any questions about our security programme, please contact our Security team directly:

For general enquiries about data protection and privacy, please refer to our Privacy Policy or contact our Data Protection Officer at the same address.

Supersei Technologies Pvt. Ltd. takes all security communications seriously and will respond to messages sent to the above address within one business day.