Security & Trust
You're evaluating the company as much as the product. Good.
An identity platform holds the keys to everything else. Here is how we secure ours — the certification, the architecture choices and the practices behind both products.
ISO/IEC 27001 certified
Our information security management system is certified to ISO/IEC 27001, with a scope covering the complete product lifecycle — design, development, delivery and support.
Deployment & data residency
On-premises, private cloud or public cloud. On-premises deployments run entirely in your own data centre: identity data, credentials and logs stay within your infrastructure and under your own security controls. Cloud deployments run in the region you choose, including India.
Credential protection
Credentials for legacy application SSO are stored encrypted, filled in by the browser extension at sign-in and, where rotation is switched on, changed automatically after every use. Administrative access to the platform itself is MFA-protected and audited.
Password rotation is optional and switched on for each application. Where it is on, Access Manager's rotation service changes the password a few seconds after each use and keeps the last few passwords as a backup, so the next sign-in always uses the current one.
Availability & resilience
High-availability topologies and disaster-recovery deployments are supported for both products — including primary + DR site architectures standard in Indian BFSI.
Our services team designs and implements these topologies, and the Infra Reckoner estimates the hardware for an on-premises or cloud deployment before you start.
Auditability
Every authentication decision, provisioning action, review sign-off and administrative change is logged for traceability. Log retention aligns with CERT-In and DPDP expectations.
The logs show who did what and when, so your team can trace any access question back to the sign-in, request or review decision behind it. Access review reports can be downloaded for your auditors.
Responsible disclosure
Found a vulnerability? Report it to [email protected] with 'SECURITY' in the subject. We acknowledge within 48 hours, keep you informed through remediation, and credit researchers who report responsibly.
Evaluating us formally? We support security questionnaires, architecture reviews and audit meetings as part of every enterprise engagement — request our security documentation.
FAQ
Common questions
Is IamLogic ISO/IEC 27001 certified?
Yes. Our information security management system is certified to ISO/IEC 27001, and the scope covers the complete product lifecycle: design, development, delivery and support.
Where is our identity data stored?
With an on-premises deployment, in your own data centre: identity data, credentials and logs never leave your infrastructure. With a cloud deployment, in the region you choose, including India.
Can our security team review IamLogic before we buy?
Yes. We support security questionnaires, architecture reviews and audit meetings as part of every enterprise evaluation, and our engineers can walk your team through deployment, encryption, credential handling and logging.
Put our architecture in front of your security team
We'll walk your architects through deployment topologies, encryption, credential handling and audit design — engineer to engineer.