Trust and compliance
How iTeamX lines up with India’s Digital Personal Data Protection Act, ISO/IEC 27001 and SOC 2.
This is our own self-assessment. iTeamX is not certified to ISO/IEC 27001 and has no SOC 2 report from an auditor yet. Use this page to see what the software does, and what you need to do on your side, when you prepare your own assessment.
Where your data is kept
- Meetings, recordings, AI notes and captions are processed on our own servers and are never sent to outside AI services.
- Every workspace gets an activity log, adjustable retention periods and a printable compliance report (Admin › Compliance).
- Built into iTeamX
- Depends on how the server is run (you or your hosting provider)
- Not done yet: on our list
Digital Personal Data Protection Act, 2023 (DPDP Act)
What the software does for the duties of a Data Fiduciary (you, the school or company) and the rights of Data Principals.
| Notice and consentSections 5, 6 | A privacy notice on every booking page; schools record each parent’s consent, with time and wording, before a student’s details are used. | Built in |
|---|---|---|
| Children’s dataSection 9 | Verifiable consent from a parent or guardian for students; no tracking, profiling or advertising aimed at children. | Built in |
| Purpose and storage limitsSection 8(7) | Each workspace sets how long recordings, chat, captions, files and AI notes are kept; old data is removed automatically. | Built in |
| Rights of Data PrincipalsSections 11–14 | Each person can download, correct or delete their own data; a parent can withdraw consent; admins can export everything. | Built in |
| Security safeguardsSection 8(5) | Encryption in transit, two-step sign-in, workspace isolation, tested backups and an activity log. | Built in |
| Breach noticeSection 8(6) | The watchdog alerts the operator; telling the Data Protection Board and the people affected is your process. | Shared |
| Grievance officerSection 8(10) | Name a contact for complaints in Owner › Website; answering within the time the rules set is your process. | Shared |
ISO/IEC 27001:2022, Annex A
The Annex A controls that a meeting and booking service can meet in the software itself.
| Access control and authenticationA.5.15, A.5.17, A.8.5 | Role-based access per workspace; two-step sign-in; company sign-in (SSO); sessions expire and can be signed out; rate limits on sign-in. | Built in |
|---|---|---|
| Cloud services and suppliersA.5.19, A.5.23 | Runs on your own server; no data sent to other providers unless you connect one. | Built in |
| Privacy and personal dataA.5.34 | Guests’ data is only used for the booking; each workspace sets how long recordings, chat, captions, files and AI notes are kept; admins can export everything, and each person can download or delete their own data. | Built in |
| BackupsA.8.13 | Nightly, tested by restoring; off-server copy optional. | Built in |
| Logging and monitoringA.8.15, A.8.16 | Owner actions are logged and the server is watched. A full activity log that workspace admins can search isn’t built yet. | Not yet |
| CryptographyA.8.24 | TLS for web and video; AES-256-GCM for stored secrets; signed links for invitations. | Built in |
| Secure development and testingA.8.25, A.8.28, A.8.29 | Every change runs our end-to-end test suites (hundreds of checks), including access checks between workspaces. | Built in |
| Independent testingA.5.35, A.8.8 | Our own security testing runs on every change (dependency audit, static analysis, and attack tests on every API: sign-in, cross-site requests, workspace isolation, injection, SSRF, token tampering). No penetration test by an outside firm yet. | Not yet |
SOC 2 Trust Services Criteria
How the software supports each criterion. A SOC 2 report needs an auditor to test your operation over time.
| Security: logical accessCC6.1–CC6.3 | Roles, two-step sign-in, SSO, and workspace isolation enforced in every database query. | Built in |
|---|---|---|
| Security: data in transitCC6.7 | HTTPS and encrypted media; webhooks only to https:// addresses and never to private networks. | Built in |
| Security: operationsCC7.1–CC7.3 | The watchdog and alerts are built in; reviewing them and responding is your process. | Shared |
| Change managementCC8.1 | Updates are one command and roll back cleanly; approving changes is your process. | Shared |
| AvailabilityA1.2, A1.3 | Automatic restarts, health checks, tested backups and a restore script. | Built in |
| ConfidentialityC1.1, C1.2 | Recordings and notes only for the meeting host; retention limits remove old data. | Built in |
| PrivacyP1–P8 | A privacy notice, retention limits and self-service deletion are built in; your privacy policy and consent process are yours. | Shared |
What stays with you
- Encrypt the server disk and keep the operating system updated.
- Turn on two-step sign-in for every admin, and company sign-in (SSO) for staff.
- Keep an off-server backup copy, and test restoring it.
- Write down who may access recordings and how long you keep them.
Need more for your assessment?
We can share architecture notes and answer security questionnaires.
Contact us