Northwind Cloud builds secure data platforms for regulated industries. This page shows how we protect customer data and the standards we are audited against.
Explore Trust Controls
We meet or exceed security, data privacy, and AI usage standards set by international frameworks.
A few of the controls we have in place. See Trust Controls for the full list.
Systems require unique user accounts with MFA or SSH keys.
All staff complete security training at onboarding and every year.
Applications and infrastructure are scanned weekly; critical findings are fixed within 7 days.
A documented incident response plan is tested twice a year.
Need a deeper look? Access our technical documentation, policy archive, and legal summaries to better understand how we manage data and risk.
We carefully vet and monitor each service provider we work with. Below is our up-to-date list of authorized subprocessors.
Cloud infrastructure for the production platform.
Customer login and identity management.
Product usage analytics (no customer content).
Recent security updates and answers to the questions we hear most.
Our annual SOC 2 Type II audit completed with no exceptions.
Customers can now keep all data in the ap-south-1 region.
Data is encrypted in transit and at rest, access is limited to authorised staff, and systems are monitored around the clock.
In AWS ap-south-1 (Mumbai) by default; other regions are available on request.
Only with the subprocessors listed on this page, under data processing agreements.
Use Request Access on any document. Our team reviews requests within two working days.