Knoxy · Trust & governance
AI your security team can approve
Knoxy is part of IMAST 360, which is hosted on AWS Mumbai, encrypts data at rest with AES-256, controls access with role-based permissions and MFA, keeps immutable audit logs, and is ISO 27001 certified and SOC 2 Type II verified.
- Hosted on AWS Mumbai (ap-south-1)
- RBAC, MFA and immutable audit logs
- ISO 27001 and SOC 2 Type II
Explained
Why AI in sales operations needs a strong security foundation
An AI chief of staff is useful because it sees a lot: orders, stock, partner details, field activity, rewards and payouts. That same breadth is why security and IT teams ask hard questions before they approve it. The data Knoxy works with is commercially sensitive, and much of it relates to real partners and employees.
Knoxy is part of IMAST 360, and the IMAST 360 platform is built to enterprise security standards. It is hosted on AWS Mumbai (ap-south-1) with VPC isolation and DDoS protection. Data at rest — databases, file storage, backups and logs — is encrypted with AES-256, using AWS KMS managed keys rotated every 90 days, with logical data isolation per customer.
Access is controlled with role-based permissions, MFA, IP whitelisting and session controls, and the platform keeps immutable audit logs. IMAST is ISO 27001 certified and SOC 2 Type II verified by independent audit, with quarterly third-party penetration tests and continuous automated vulnerability scanning.
Platform controls
The foundation Knoxy runs on
IMAST 360 platform security, as published in our Security Center.
Hosted in India
Hosted on AWS Mumbai (ap-south-1), with VPC isolation and DDoS protection.
Encryption
AES-256 encryption at rest for databases, file storage, backups and logs; AWS KMS keys rotated every 90 days.
Access control
Role-based access, MFA, IP whitelisting and session controls.
Audit trail
Immutable audit logs.
Certified
ISO 27001 certified and SOC 2 Type II verified by independent audit.
Tested
Quarterly third-party penetration tests and continuous vulnerability scanning.
How to evaluate
What to ask before approving any AI tool for your channel
Security reviews of AI tools go faster when the right questions are asked up front. Whatever vendor you are assessing, ask where data is hosted, how it is encrypted, how access is controlled and logged, and which independent certifications back those claims.
Ask for evidence rather than assurances: certification reports, penetration test summaries and documented access controls. Our team can walk your IT and security leads through IMAST 360's controls and answer your security questionnaire.
- Where is the data hosted?
- Is data encrypted at rest, and how are keys managed?
- How are access and permissions controlled?
- Is there an immutable audit trail?
- Which independent certifications apply?
Learn more
Security and compliance details
Full details live in our Security Center.
For IT and security teams
Preparing your security review
Most enterprise security reviews follow the same pattern: where data is hosted, how it is protected at rest and in transit, who can access it, how access is logged, and what independent assurance exists. IMAST 360's answers to the platform questions are published in the Security Center, so your team can start the review before the first call.
Hosting is on AWS Mumbai (ap-south-1), fully managed by IMAST's internal team, with VPC isolation and DDoS protection. Data at rest is encrypted with AES-256, with AWS KMS managed keys rotated every 90 days and logical data isolation per customer.
Access is controlled through role-based permissions, MFA, IP whitelisting, session timeouts and concurrent session limits, and the platform keeps immutable audit logs. IMAST is ISO 27001 certified and SOC 2 Type II verified, and runs quarterly third-party penetration tests with continuous vulnerability scanning.
If your organisation uses a standard vendor questionnaire, send it before the evaluation. Our team will complete it and walk your IT and security leads through the answers.
- Start from the published Security Center facts
- Map your questionnaire to hosting, encryption, access and audit
- Ask for the independent audit reports you need
- Involve IT early, not after the commercial decision
FAQs
Knoxy security FAQs
Where is IMAST 360 hosted?
On AWS Mumbai (ap-south-1), fully managed by IMAST's internal team.
Is data encrypted?
Yes. Data at rest is encrypted with AES-256, with AWS KMS managed keys rotated every 90 days and logical data isolation per customer.
Which certifications does IMAST hold?
IMAST is ISO 27001 certified and SOC 2 Type II verified.
Is there an audit trail?
Yes. IMAST 360 keeps immutable audit logs.
How is access controlled?
Through role-based access control, MFA, IP whitelisting, session timeouts and concurrent session limits.
Is each customer's data kept separate?
Yes. IMAST 360 uses logical data isolation per customer, with AES-256 encryption at rest.
Is IMAST 360 tested by third parties?
Yes. The platform has quarterly third-party penetration tests and continuous automated vulnerability scanning.
Where can our IT team read the security details?
In the IMAST Security Center at /security, which covers hosting, encryption, access control, audit logs, certifications and testing.
Do you complete vendor security questionnaires?
Yes. Send your questionnaire and our team will complete it and walk your IT and security leads through it.
Bring your security questionnaire
Our team will walk your IT and security leads through it.