For IT & security teams
A platform your IT and security teams can approve
For IT and security teams, IMAST 360 is a SaaS platform hosted on AWS Mumbai, with AES-256 encryption at rest, role-based access control, MFA, immutable audit logs, ISO 27001 certification and SOC 2 Type II verification — and REST APIs and connectors for integrating with the systems you already run.
- Hosted on AWS Mumbai (ap-south-1)
- ISO 27001 and SOC 2 Type II
- RBAC, MFA, SSO/SAML and audit logs
Security controls
What the platform provides
As published in the IMAST Security Center.
Hosting
Hosted exclusively on AWS Mumbai (ap-south-1), with VPC isolation and DDoS protection.
Encryption
AES-256 at rest for databases, file storage, backups and logs; AWS KMS keys rotated every 90 days.
Access control
Role-based access, MFA, IP whitelisting, session timeouts and concurrent session limits.
Audit logs
Immutable audit trails.
Certifications
ISO 27001 certified and SOC 2 Type II verified by independent audit.
Testing
Quarterly third-party penetration tests and continuous vulnerability scanning.
Why it matters
What IT should check before approving a channel platform
Channel and loyalty platforms hold sensitive data: partner identities, KYC details such as PAN and bank accounts, purchase history and payout records. Before approving one, IT and security teams usually want to know where data is hosted, how it is encrypted, who can access it and how access is logged.
IMAST 360 is hosted exclusively on AWS Mumbai, so primary data stays in India. Data at rest is encrypted with AES-256, using AWS KMS managed keys that rotate every 90 days, with logical data isolation per customer.
Access is controlled through role-based permissions, MFA, IP whitelisting and session controls, and audit logs are immutable. The platform is ISO 27001 certified and SOC 2 Type II verified, and is tested quarterly by third-party penetration testers.
Integration
How IMAST 360 connects to your systems
Native links inside IMAST 360, plus APIs for everything else.
| Need | How | Notes |
|---|---|---|
| Single sign-on | SSO / SAML | LoyaltyBoard Enterprise plan |
| ERP and accounting | Pre-built connectors (e.g. SAP, Tally) and REST APIs | Advanced integrations available as an add-on |
| Third-party DMS | REST APIs | LoyaltyBoard Enterprise plan |
| Rewards in your own apps | Reward Max REST APIs, SDKs, webhooks, embeddable storefront | API-first |
| Between IMAST products | Native data flow | e.g. Distribution+ purchase data into LoyaltyBoard |
Data lifecycle
Retention, incidents and data protection
The Security Center sets out how long data is kept: for the duration of the subscription while an account is active, with deletion after account closure on a defined schedule and backups purged afterwards. Billing records are kept as required by Indian tax law.
For incidents, IMAST commits to notifying customers within 72 hours and documenting a root cause analysis. For data protection, IMAST acts as controller for its own data and as processor for customer data, processing it on the customer's instructions.
These details, along with the full list of certifications, are published in the Security Center and Compliance pages, which are a good starting point for a vendor security questionnaire.
Practical advice
Running a smooth security review
Share your questionnaire early. Most of the answers — hosting, encryption, access control, certifications, testing — are standard and published, so the review can focus on what is specific to your integration.
Agree the integration scope up front: which systems connect, in which direction, and which team owns each data type. Most integrations go live within the first week once the scope is clear.
Decide your access model before go-live. Map roles in your organisation to permissions in IMAST 360, switch on MFA and SSO where your plan includes it, and agree who reviews audit logs.
- Send the security questionnaire early
- Agree integration scope and data ownership
- Map roles to permissions; enable MFA and SSO
- Decide who reviews audit logs
FAQs
IT & security FAQs
Where is IMAST 360 hosted?
Exclusively on AWS Mumbai (ap-south-1), fully managed by IMAST's internal team.
How is data encrypted?
AES-256 at rest for databases, file storage, backups and logs, with AWS KMS managed keys rotated every 90 days and logical data isolation per customer.
Which certifications does IMAST hold?
IMAST is ISO 27001 certified and SOC 2 Type II verified. See the Compliance page for the full list.
Is SSO supported?
SSO / SAML is available on the LoyaltyBoard Enterprise plan.
How is access controlled?
Role-based access control, MFA, IP whitelisting, session timeouts and concurrent session limits, with immutable audit logs.
How often is the platform tested?
Quarterly third-party penetration tests and continuous automated vulnerability scanning.
Does IMAST have APIs?
Yes. REST APIs across the platform; Reward Max is API-first with SDKs, webhooks and embeddable storefronts.
How quickly are incidents reported?
IMAST commits to notifying customers within 72 hours, with a documented root cause analysis.
Bring your security questionnaire
Our team will walk your IT and security leads through it.