Data Processing & Confidentiality Principles

1. Data Protection Architecture

As an advanced technology and growth consultancy, Clytrio (“we,” “us,” establishing as Clytrio Private Limited, Thrissur, Kerala) is frequently entrusted with access to client staging servers, code repositories, advertising accounts, customer relationship management (CRM) systems, and analytics consoles.

We take this trust with the utmost seriousness. This document outlines the administrative, technical, and physical safeguards we employ to maintain the confidentiality, integrity, and availability of client information in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and internationally recognized information security benchmarks.

2. Clytrio as Data Processor vs. Data Fiduciary

Under modern data privacy frameworks:

• Data Fiduciary (Data Controller): For information submitted directly through our website (such as contact forms, consultation bookings, or newsletter sign-ups), Clytrio acts as the Data Fiduciary. Our practices are set forth in our Privacy Policy.
• Data Processor: When we build custom applications, configure CRM pipelines, integrate WhatsApp Business APIs, or manage ad targeting on behalf of our clients, the client remains the Data Fiduciary of their end-users' data, and Clytrio acts strictly as a Data Processor. In this capacity, we process personal data solely on documented instructions from the client.

3. Access Control & Credential Security

We enforce strict organizational hygiene regarding client systems and production credentials:

• Principle of Least Privilege: Team members are granted access strictly on a need-to-know basis required to complete their assigned project sprint.
• Zero Plaintext Storage: Production passwords, API secret keys, and database tokens must never be transmitted via unencrypted channels (such as basic email or consumer messaging apps). We mandate encrypted enterprise password managers (e.g., 1Password, Bitwarden) and environment-level secret variables.
• Mandatory Multi-Factor Authentication (MFA): All developer workstations, GitHub repositories, cloud infrastructure consoles, and internal communication platforms require hardware-backed or authenticator-app 2FA.
• Prompt Credential Offboarding: Upon completion of a development phase or service contract, our project managers revoke internal access tokens and remind the client to cycle production API keys and staging credentials.

4. Strict Commercial Confidentiality

We treat all non-public information received from a client—including customer databases, financial figures, unpublished marketing strategies, source code repositories, product roadmaps, and business models—as strictly confidential.

• All Clytrio engineers, designers, and contractors are bound by legally enforceable non-disclosure and confidentiality agreements.
• We do not disclose, distribute, copy, or monetize client proprietary data for any unauthorized secondary purpose.
• We gladly execute standard bilateral Non-Disclosure Agreements (NDAs) prior to receiving confidential technical documentation.

5. Authorized Sub-Processors

To deliver modern cloud development and analytics, we engage vetted sub-processors that maintain robust security postures (such as SOC 2 Type II and ISO 27001 certifications). Our primary infrastructure partners include:

• Vercel Inc. — Frontend edge deployment and serverless compute infrastructure.
• Supabase Inc. (AWS) — Managed PostgreSQL databases with encrypted storage at rest.
• Cloudflare Inc. — Edge DNS, SSL/TLS encryption, and web application firewall security.

6. Security Incident Response Protocol

In the unlikely event of a confirmed security incident affecting systems under Clytrio's direct management that compromises client data:

1. We will contain and remediate the vulnerability immediately.
2. We will notify the affected client in writing without undue delay (and within 48 hours of verification).
3. We will provide a detailed technical briefing outlining the nature of the event, categories of data affected, and remedial actions taken.
4. We will cooperate fully with the client's incident response and regulatory reporting obligations under Indian law.

7. Data Deletion & Handover at Termination

Upon formal termination of a service agreement, Clytrio will:

• Deliver all finalized deliverables, code repositories, and compiled assets to the client;
• Securely delete all local staging copies, database dumps, and credential vaults containing client proprietary data within 30 days, retaining only standard audit and billing records required by Indian corporate and tax legislation.

8. Executing a Bilateral Data Processing Agreement (DPA)

For regulated enterprises, healthcare providers, financial institutions, or international clients subject to GDPR or India's DPDP Act, we offer our standardized bilateral Data Processing Agreement (DPA) incorporating statutory Standard Contractual Clauses.

To execute a DPA or discuss custom security requirements, please contact our data governance team at privacy@clytrio.com.