Trust, thoughtfully built

Security Architecture

• Encryption at Rest & in Transit Across All Data Layers
• Role-Based Access Control (RBAC) Enforced by Default
• SSO & Multi-Factor Authentication (MFA) Across All Surfaces
• Administrative Access Restricted & Fully Logged
• Unique Access IDs – No Shared Credentials
• Least Privilege Principle Applied Across All Revenue OS Modules
• Encryption & Key Management Policy
• Asset Inventory – Full Coverage of LLM, Agentic & Integration Stack
• User Access Reviews (Quarterly)
• Access Removal on Role Change or Offboarding
• REST & Webhook API Secured with Token-Based Authentication

Platform Reliability

• 99.9% Uptime SLA – Contractually Guaranteed
• High Availability Configuration for Stream Processor (Flink) & Query Engine (Trino)
• Real-Time Processing Architecture Built for Scale
• Automated Backup Process for Knowledge Graph & Vector DB
  Backup Restoration Testing
• Failover Procedures for Singapore Data Centre
• Uptime & Real-Time Availability Monitoring
• Scalability Layer Built for High-Growth B2B
• Error Handling & Observability Across Q Engine

Engineering & Release Controls

• Segregation of Development, Staging & Production Environments
• Secure Development Lifecycle Policy
• Software Change Testing Before Every Deployment
• Baseline Configuration Standards for Q Orchestration Engine
• Production Data Use is Restricted
• Code Review & Approval Process for Revenue OS Modules
• Configuration & Asset Management Policy

AI Integrity & Transparency

• Purpose-Built Q Orchestration Engine – No Third-Party Black Box
• Multi-LLM Architecture (OpenAI, Claude, Gemini, LLaMA, Groq) with Controlled Fallbacks
• Semantic Search Powered by Isolated Vector DB Per Tenant
  Knowledge Graph for Account Intelligence - Auditable Signal Sources
• Agentic Framework with Human-in-the-Loop Controls
• RAG Pipeline for Contextual Accuracy – Not Hallucination
• No-Code Builder – AI Workflows Without Engineering Risk
• LLM Compute Layer Security Reviews (Bi-Annual)
• Agentic Framework Security Assessment (LangChain, LlamaIndex)

Data Ownership & Privacy

• Data Never Sold – Zero Exceptions, Contractually Binding
• Zero Data Breach Record – Maintained Since Inception
• Data Classification Policy (Unstructured, Semi-Structured, Structured)
• CRM & Deal Data Treated as Confidential by Default
• Calls & Emails Processed with Strict Privacy Controls
• KPI & Metrics Data Isolated Per Tenant
• Retention & Disposal of Customer Data Policy
• Data Residency Options – Confined to Declared Regions
• GDPR Compliant by Design
• Customer Data Deletion on Request – Fully Honoured

Network & Infrastructure Defence

• Network Traffic Monitoring Across All Access Layers (Web, Mobile, API)
• Automated Alerting for Anomalous Security Events
• Restricted Port Configurations
• Logging & Monitoring for Threats Across Q Engine
• Network Security Policy
• Singapore Data Centre – Tier III Facility Standards
• Physical Access Controls & CCTV Monitoring at Data Centre
• Data Residency Confined to Declared Regions

Threat & Vulnerability Management

• Vulnerability & Patch Management Policy
• Third-Party Penetration Testing (Regular Cadence)
• Automated Vulnerability Scanning Across All Infrastructure
• Bug Bounty Program – Responsible Disclosure Welcomed
• Security Reviews Across 200+ Integration Partners
• Vendor Risk Assessment – Salesforce, HubSpot, ZoomInfo, Apollo & More

Incident & Crisis Readiness

• Incident Response Plan – Defined, Documented & Tested
• Security Incident Tracking & Classification
• Lessons Learned Reviews Post-Incident
• Incident Response Plan Testing (Bi-Annual)
• Customer Notification Protocol for Security Events
• Business Continuity & Disaster Recovery Policy
• Disaster Recovery Testing – Regular Cadence

Compliance & Risk Governance

• SOC 2 Type II Certified
• ISO 27001 Aligned
• GDPR Compliant
• Enterprise Risk Register – Maintained & Reviewed Quarterly
• Vendor Due Diligence Review for All Integration Partners
• Cybersecurity Insurance Coverage
• Third-Party Audit Reports Available on Request
• Internal Control Monitoring & Policy Review Cycle

People & Organisational Security

• Background Checks & New Hire Screening
• Security Awareness Training for All Personnel
• Roles & Responsibilities Across Revenue OS Teams
• Code of Conduct & Acceptable Use Policy
• Personnel Acknowledgement of Security Policies
• Disciplinary Action Policy
• Performance Review Policy
• Confidential Reporting Channel for Security Concerns

Ecosystem & Integration Trust

• 200+ Pre-Built Integrations – Each Vendor Risk Assessed
• OAuth-Secured Third-Party Connections
• No Vendor Lock-In Architecture
• Salesforce, HubSpot, LinkedIn Sales Nav, ZoomInfo – Compliant Connectors
• Zapier, SAP, Outlook, Slack – Security-Reviewed Integrations
• API-First with REST & Webhook Access – Token Authenticated

Transparency & Legal Commitments

• Privacy Policy – Plain Language, No Legal Jargon
• Terms of Service
• Description of Platform Services & Agent Q Behaviour
• Communication of Security Commitments to Customers
• Communication of Critical Updates & Incidents in Real Time
• Confidential Reporting Channel for Security Concerns
• Cookie Policy
• Data Processing Agreements Available on Request