Moving beyond digital movement of papers, MYND Intelligent Document Processing engine automates processing of documents through Proprietary Intelligent OCR & Advanced analytics where by processes are converted into Straight Through Process & Management by Exception.
Security FAQComprehensive answers to your security, compliance, and data protection questions about MYND IDP Engine.
We have an Information Security Management System (ISMS) in place derived from ISO standards, which takes into account our security objectives and the risks and mitigations concerning all the interested parties. We have achieved ISO 27001 certification to demonstrate our compliance with the standards.
Access to your data is restricted to a small number of employees on a need-to-know basis in order to provide you technical support. This access is reviewed periodically.
We encrypt customer data both in transit and at rest. Data at rest is encrypted using industry-standard AES-256. All customer data is encrypted in transit over public networks using Transport Layer Security (TLS) 1.2/1.3
Our framework distributes and maintains the cloud space for our customers. Data of multiple customers is logically separated from each other and our framework ensures that no customer's service data becomes accessible to another customer.
We use technologies from well-established and trustworthy service providers, who offer multiple DDoS mitigation capabilities to prevent disruptions caused by such attacks.
Yes, we conduct Vulnerability assessment & Penetration testing annually by third party. Vulnerability assessment & Peneteration test of MYND ACT was conducted on "2nd November 2022".
We have a dedicated Incident Response Team which is responsible for incident detection, assessment, and recovery activities. In cases where we are controllers of data and an incident leads to a data breach, the affected customers will be notified within 72 hours after we become aware of it. In cases where we are processors of data and an incident leads to a data breach, the respective controllers will be informed without undue delay. For incidents specific to an individual user or an organization, we will notify the concerned party through email (using their primary email address). The Complete report will be provided to customers on request within 5 to 7 working days.
We notify the incidents that apply to you, along with suitable actions that you may need to take. We track and close the incidents with appropriate corrective actions. Whenever applicable, we provide you with necessary evidences regarding incidents that apply to you. Root Cause Analysis will be provided on request.
Additional security features that can be availed by customers:
We hold the data in your account as long as you choose to use MYND Services. Once you terminate your MYND user account, your data will eventually get deleted from active database immediately and we will share the destruction certificate to the client.
We have a business continuity plan and Disaster Recovery Plan in place. Our Data Center in Mumbai and DR in Delhi with RTO (8 hours) and RPO (2 hours)
We have a risk assessment policy and procedure to identify, analyze and mitigate risks by implementing appropriate controls. We perform risk assessment for every major change that happens in our environment. The overall risks are reviewed and updated once in a year.
Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users.
We are certified in ISO 27001:2022 and ISO 27701:2019, and compliant with SOC 1 Type II and SOC 2 Type II across Security, Confidentiality, Processing Integrity, Availability, and Privacy. Annual ISO and SOC audits are conducted, covering all critical and essential controls.
Yes, We have documented change Management Policy in place and all changes are captured in JIRA application.
Yes, data at rest is encrypted with AES256 bit encryption
Yes, data is transit is encrypted with TLS 1.2/TLS 1.3
While working from home, MYND user will connect the VPN to access the data. USB is blocked for employees for data security.
MYND network is accessible by employees only if authorized by an appropriate login and password. We have a password protected screen saver and desktop locking mechanism is activated when the workstation is unattended. USB are blocked for the users and Acceptable use policy is in place. Data at rest is encrypted with AES256 bit. Under ISO 27001 information security framework, we have included all IT systems controls to maintain the data security at each layer, and each data state.
External audit of ISO27001:2013 done by third party (BSI). MYND has done surveillance audit of Information Security Management System in Apr'25.
As per SOP, infrastructure uptime is followed to be higher than 99.95%
MYND has Industry standard password policy that ensures minimum of 8 characters with stronger complexity of numeric and special characters combination.
No initial password is provided to any user in the system. User needs to reset a password directly in the product.
Concurrently 5 time login with wrong password then account is lock of current user.
Yes, MYND has documented and approved Information Security policy in place. MYND is committed to protect the Confidentiality, Integrity, and Availability of information entrusted to it by its stakeholders, and will strive to be compliant to all relevant and applicable legal, regulatory, statutory and contractual obligations. We are also committed to continually improving the ISMS by adopting the best practices and Technology prevalent in the Industry.
Yes, we have Information Security Steering Committee is in place and half yearly meeting is being conducted to ensure the information security is being followed and maintained
We have Data Classifying and asset management is in place. Based on type of information, it is labelled as restricted, confidential, internal, and public.
All electronic scrap items like Hard disk, compact disk, magnetic tapes, computer accessories etc. are handed over to government approved e-recycler agency for safe disposal and paper records shall be disposed of as per the framed retention and destruction schedule using the paper shredder.
We have background verification process and NDA is signed for all employees. For contractors, we have an NDA and Background verification clause with the contracting company in our agreement.