Skip to content
PYD ENTERPRISES
Start free trial

Trust center

Evidence for your vendor risk review.

Audit reports, policies, controls and subprocessors in one place. Reports are shared under a mutual NDA, usually within one business day.

Request documentsSecurity architecture
COMPLIANCE STATUSCurrent
  • SOC 2 Type IIReport issued Aug 2026
  • ISO/IEC 27001:2022Certified Apr 2026
  • FIPS 140-2Validated modules in FIPS mode
  • Penetration testSep 2026, findings remediated
  • DPDP Act, 2023Data fiduciary processes in place

Document library

Reports and policies.

Add the documents you need to one request. Public documents open directly.

  • SOC 2 Type II report

    Security, availability and confidentiality criteria, issued by an independent CPA firm.

    Observation period Feb 2026 to Jul 2026 · issued Aug 2026

  • ISO/IEC 27001:2022 certificate and Statement of Applicability

    Scope: engineering, customer support, license service and update distribution.

    Certified Apr 2026 · surveillance audit due Apr 2027

  • Penetration test summary

    Third-party test of the PYD ENTERPRISES console, API, Helm deployment defaults and license verification.

    Tested Sep 2026

  • Security architecture whitepaper

    Air-gapped deployment, data flows, FIPS 140-2 module list, signing chain and hardening guide.

    Version 2.3 · Oct 2026

  • Completed security questionnaire (CAIQ v4)

    Pre-filled answers for vendor risk teams, mapped to self-hosted deployment.

    Updated Oct 2026

  • Release SBOM

    CycloneDX bill of materials for the current release, with license and vulnerability status.

    Release 2026.11

  • Data Processing Addendum

    Processing terms for support and license data, with Standard Contractual Clauses.

    Updated 1 Oct 2026

    View

  • Privacy Policy

    Includes India's Digital Personal Data Protection Act, 2023 commitments.

    Updated 1 Oct 2026

    View

NDA REQUEST

Select one or more documents marked “Request under NDA”. We send a mutual NDA for e-signature and share the documents once it is countersigned.

Controls

What we hold ourselves to.

Product security

  • Deny-all egress supported and tested every release
  • Offline license verification, no callbacks
  • Images signed, verified on import
  • Non-root containers, read-only root filesystems
  • FIPS 140-2 validated crypto modules in FIPS mode

Access control

  • SSO with phishing-resistant MFA on all internal systems
  • Least-privilege roles, reviewed quarterly
  • No standing access to any customer environment
  • Customer-issued accounts for on-site assistance

Secure development

  • Peer review on every change
  • SAST, dependency and container scanning in CI
  • Parser regression suites from compiler listings
  • Annual third-party penetration test

Operations

  • Encrypted backups of license and support systems
  • Centralized logging with 1-year retention
  • Incident response plan tested twice a year
  • Status page for license and update services

People

  • Background checks where local law permits
  • Security training at hire and annually
  • Confidentiality agreements for all staff
  • Offboarding within 24 hours

Privacy

  • No customer source code processed on PYD ENTERPRISES systems
  • DPDP Act, 2023 and GDPR processes
  • Subprocessor notice 30 days in advance
  • Breach notice to customers within 48 hours

Subprocessors

Short list, no source code.

Our subprocessors support the website, license service, email, support and back office. None of them receives customer code.

Full subprocessor list
Subprocessors of PYD ENTERPRISES PRIVATE LIMITED
SubprocessorPurposeLocationSource code
Amazon Web Services (Mumbai and N. Virginia regions)Hosting for pydenterprises.com, the license issuance service and the update bundle download portalIndia, United StatesNever
Content delivery network providerCaching and TLS termination for pydenterprises.com and signed bundle downloadsGlobal edge networkNever
Transactional email providerLicense delivery emails, support notifications, status updatesUnited StatesNever
Support ticketing platformCustomer support tickets and knowledge baseUnited States, European UnionNever
CRM platformSales inquiries, trial and Discovery Scan requests, partner recordsUnited StatesNever
Accounting and invoicing platformInvoices, payments and tax recordsIndiaNever
Privacy-preserving web analytics (consent only)Aggregate page analytics on pydenterprises.com after opt-inEuropean UnionNever

Vulnerability disclosure

Found something? Tell us first.

Email security@pydenterprises.com with a description, affected version and reproduction steps. Our contact details are also published in /.well-known/security.txt.

  • We acknowledge reports within 2 business days and share a remediation timeline within 10.
  • We will not pursue legal action for good-faith research that avoids privacy violations, data destruction and service disruption.
  • Test only against your own PYD ENTERPRISES installation or pydenterprises.com. Never test against a customer environment.
  • We credit researchers in release notes unless you prefer otherwise.
/.well-known/security.txtText
Contact: mailto:security@pydenterprises.com
Expires: 2027-10-T00:00:00.Z
Preferred-Languages: en
Canonical: https://pydenterprises.com/.well-known/security.txt
Policy: https://pydenterprises.com/security/trust-center#disclosure

Walk your security team through the architecture.

A PYD ENTERPRISES security engineer will review the air-gapped deployment, data flows and signing chain with your assessors.

Book technical walkthroughStart 14-day trial