SOC 2 Type IICurrent
An independent auditor tested our security, availability and confidentiality controls over a full audit period.
- Audited by
- Atom Assurances LLC
- Valid until
- 30 November 2026
- Scope
- IMAST 360 platform and supporting infrastructure
IMAST TRUST CENTER · SECURITY, PRIVACY, COMPLIANCE
Security your auditors can verify, not just read about
IMAST 360 runs the money and data of your channel: partner records, orders, rewards and payouts. Here is exactly how we protect it, who checks us, and the documents your security team needs to approve us.
Last reviewed 25 October 2026 by the IMAST security team
Compliance at a glanceUpdated 25 October 2026
- SOC 2 Type IIAtom Assurances LLC · valid to 30 November 2026Current
- ISO/IEC 27001:2022GCAI Certification Services LLP · valid to 8 December 2028Certified
- ISO/IEC 27017GCAI Certification Services LLP · valid to 8 December 2028Certified
- ISO/IEC 27018GCAI Certification Services LLP · valid to 8 December 2028Certified
- GDPRSelf-assessed · reviewed 1 April 2026Aligned
- DPDP Act, 2023Self-assessed · reviewed 1 April 2026Aligned
Customer data hosted in Mumbai, India
- Data residency
- India
- Mumbai region
- Data at rest
- AES-256
- Databases, files, backups, logs
- Data in transit
- TLS 1.2+
- Including service to service
- Production access
- MFA only
- Least privilege, reviewed quarterly
- Audit trail
- Immutable
- Every admin action logged
- Breach notice
- ≤ 72 hours
- With a root-cause report
Certifications & frameworks
Independently audited, with the evidence one click away
Every certificate shows who audited us, the scope, and when it expires. Reports that contain control details are shared under NDA.
ISO/IEC 27001:2022Certified
Our information security management system meets the international standard, with yearly surveillance audits.
- Audited by
- GCAI Certification Services LLP
- Valid until
- 8 December 2028
- Scope
- Development, hosting and support of IMAST 360
ISO/IEC 27017Certified
Cloud-specific security controls for how we build and run a SaaS platform.
- Audited by
- GCAI Certification Services LLP
- Valid until
- 8 December 2028
- Scope
- Cloud services of IMAST 360
ISO/IEC 27018Certified
Protection of personal data processed in the cloud, including your partners' details.
- Audited by
- GCAI Certification Services LLP
- Valid until
- 8 December 2028
- Scope
- Personal data processed in IMAST 360
GDPRAligned
Processing follows GDPR, with Standard Contractual Clauses for any EU data transfers.
- Audited by
- Self-assessed
- Last reviewed
- 1 April 2026
- Scope
- Customer and partner personal data
DPDP Act, 2023Aligned
India's Digital Personal Data Protection Act: consent, purpose limits, breach reporting and data principal rights.
- Audited by
- Self-assessed
- Last reviewed
- 1 April 2026
- Scope
- All Indian partner and customer data
Security controls
What protects your data, control by control
Pick an area. Each control is written the way your security questionnaire asks it.
InfrastructureWhere IMAST 360 runs and how it is isolated4 CONTROLS IN PLACE
- Hosted in Mumbai, IndiaCustomer data is hosted in India, in an environment managed by IMAST's own team.
- Network isolationIsolated private networks with strict segmentation. Firewall rules restrict all traffic between services.
- DDoS protectionManaged DDoS protection on every public endpoint.
- Uptime commitment99.9% uptime, measured monthly, with planned maintenance announced 48 hours in advance.
In your admin console
Security settings your own IT team controls
Role-based accessSeparate roles for head office, regional managers, field reps, distributors and partners, so each person sees only what their role needs.
Multi-factor authenticationAvailable on every customer account, so admins can require a second factor to sign in.
IP allow-listingLimit admin access to your office network or VPN.
Your data, exportableExport anytime as CSV, JSON or PDF. No lock-in, no export fees.
Program integrity
Protection for the money that moves through your channel
Server security is only half of it. In a loyalty or incentive program the bigger risk is leakage: fake scans, ghost visits, duplicate claims and payouts to the wrong person. IMAST checks every one of those before money leaves your account.
LoyaltyBoardEvery QR code pays onceEach code is single-use. Repeat scans, and many scans from one device, are flagged for review.
Reward MaxKYC before any payoutPartners verify identity and bank or UPI details before redeeming, so rewards reach the right person.
Reward MaxTDS handled on every payoutSection 194R deducted and recorded automatically, so finance closes the year without surprises.
Sales TrackGPS-verified visitsCheck-ins are matched to the outlet's location, so visit reports reflect real visits.
All productsApproval levels for large claimsClaims above your limits go to a second approver, and every decision is in the audit log.
TrueViewWarranty claims validatedWarranty claims are validated before approval, across every service centre.
Knoxy watches for fraud patterns all day. Example alert: “14 duplicate QR scans from one device. Flagged for review.”98% warranty compliance, case study →
AI governance
Knoxy follows the same rules as your people
Knoxy, the AI Chief of Staff, runs inside IMAST 360. It is hosted in the same environment in Mumbai, India and protected by the same encryption, access controls and audit logs.
Read Knoxy trust & governance →- 01Hosted with your data, in IndiaKnoxy works on the platform where your data already lives.
- 02Role-based, and loggedKnoxy sees only what each user's role allows, and its actions appear in the immutable audit log.
- 03Covered by the same certificationsKnoxy is part of IMAST 360, so ISO 27001 and SOC 2 Type II apply to it too.
Privacy & your data
Your data stays yours, from first login to final deletion
We never sell or rent customer data. You own it, you can export it, and when you leave we delete it on a published schedule.
- During your contractExport anytimeCSV, JSON or PDF, whenever you need it.
- After termination30 days to exportYour data stays available to download.
- Within 90 daysDeleted from productionRemoved from live databases and file storage.
- 30 days laterPurged from backupsBackup copies expire on their own cycle.
- Required by lawBilling kept 7 yearsInvoices only, as Indian tax law requires.
Your rights, answered in 30 daysAccess, correction, erasure, nomination and grievance redressal. Write to privacy@imast.in, or withdraw consent at imast.in/withdraw-consent.
Grievance OfficerRahul Dubey, Head, Internal Audit, grievance@imast.in. Data protection questions: dpo@imast.in.
Data Processing AgreementA standard DPA for every customer, covering IMAST as processor of your partners' data.
Incident response
If something goes wrong, you hear it from us first
Our incident response plan follows the NIST SP 800-61 lifecycle and the incident management controls of ISO/IEC 27001 (Annex A 5.24–5.28). It is written down, owned by a named incident lead, and covers every severity below.
- 01 · PreparePreparationWritten plan, on-call rota and runbooks for each incident type.
- 02 · DetectDetection & analysis24/7 automated alerting. Every alert is triaged and given a severity.
- 03 · ContainContainmentIsolate affected systems and accounts to stop the impact spreading.
- 04 · RecoverEradication & recoveryRemove the cause, restore from clean backups, verify before reopening.
- 05 · LearnPost-incident reviewRoot-cause analysis, fixes tracked to closure, and a report to affected customers.
Severity levels and response times
| Severity | What it means | Acknowledge | Engineer engaged | Customer updates |
|---|---|---|---|---|
| SEV 1 · Critical | Platform down for many customers, or a confirmed data breach | 15 minutes | 1 hour | Every hour |
| SEV 2 · High | A core feature unavailable, or a suspected breach | 1 hour | 4 hours | Every 4 hours |
| SEV 3 · Medium | Degraded performance with a workaround | 4 hours | 1 business day | Daily until resolved |
| SEV 4 · Low | Minor issue, no business impact | 1 business day | 3 business days | On resolution |
CustomersTold within 72 hoursAffected customers hear from us without undue delay, and within 72 hours of a confirmed breach of their data.
RegulatorsCERT-In and the Data Protection BoardReportable cyber incidents are reported to CERT-In within 6 hours of being noticed, and personal data breaches to the Data Protection Board of India, as Indian law requires.
AfterwardsA written root-cause reportWhat happened, what data was affected, what we fixed and what changes to stop it happening again.
Report a security incident, 24/7: security@imast.in
Document library
Everything your security review asks for
Every document is shared on request. Email us from your work address and tell us which ones you need. Confidential reports are sent after a mutual NDA.
- ISO/IEC 27001, 27017, 27018 certificatesIssued by GCAI Certification Services LLP, valid until 8 December 2028ON REQUEST
- Data Processing AgreementStandard DPA, ready to signON REQUEST
- GDPR and DPDP summariesHow we meet each law, last reviewed 1 April 2026ON REQUEST
- SOC 2 Type II reportBy Atom Assurances LLC, valid until 30 November 2026REQUEST + NDA
- Penetration test summaryLatest third-party test and fixesREQUEST + NDA
- Completed security questionnaireCAIQ / SIG Lite, or your own formatREQUEST + NDA
Request by emailEmail us and we send the reports you needcompliance@imast.in
Include in your email
- Your name, company and role
- The documents you need from the list
- Send it from your work email address
- 01We confirm your request
- 02NDA for confidential reports
- 03Reports sent to your inbox
Responsible disclosureFound a vulnerability? Tell us.Email security@imast.in with steps to reproduce. We acknowledge within 24 hours, keep you updated until it is fixed, and will not take legal action against good-faith research that follows this policy.imast.in/.well-known/security.txt
PoliciesOur legal policiesThis page summarises how we protect your data. The signed-off legal versions are on these pages.
For procurement and IT
Questions security reviews always ask
Where is our data stored?
In Mumbai, India. Backups are encrypted and stay in the same environment.
Can we get your SOC 2 report?
Yes. Email compliance@imast.in from your work address. We send it after a short mutual NDA.
Do you support MFA and IP restrictions?
Yes. Multi-factor authentication is available on every account, and admin access can be limited to your office network or VPN.
Will you fill in our security questionnaire?
Yes. We have a completed CAIQ / SIG Lite, and our team fills in custom questionnaires too.
How fast will you tell us about a breach?
Within 72 hours of confirming it, followed by a root-cause report.
What happens to our data if we leave?
You get 30 days to export it. It is deleted from production within 90 days and from backups 30 days after that.
Talk to our security team · security@imast.in · compliance@imast.in · dpo@imast.inBook a security walkthrough