Security

What we do not claim

Eaglora is not ISO 27001 certified. You will find products in this market advertising the standard loosely; we would rather state the position than imply one. What we can say is that the platform is built to the principles the standard describes — least-privilege access, encryption in transit and at rest, audited changes, and documented backup and recovery.

If certification is a procurement requirement for you, tell us early and we will tell you honestly whether we can meet your timeline.

Data handling

The specifics below are confirmed in writing as part of any contract, and we will complete a security questionnaire before you commit to anything.

• Hosting region — confirmed per customer, and stated in the agreement.
• Encryption — TLS in transit; encryption at rest on the database and on stored documents.
• Access control — role-based, with employee data restricted by department and cost centre rather than open to every logged-in user.
• Audit — changes to payroll and employee records are attributable to a user and a time.
• Backups — taken on a defined schedule with a stated retention period and a tested restore procedure.
• Sub-processors — listed on request, including anything used by the AI Copilot.

The AI Copilot

The Copilot reads your data to answer questions; it does not run payroll, approve requests or modify records. Which data is sent to a model, which is not, and how long anything is retained are set out in the data processing agreement rather than left to inference.

Reporting a vulnerability

If you believe you have found a security issue, email hello@cloudkitesolutions.in with enough detail to reproduce it. We will acknowledge and keep you updated. Please do not test against another customer's data.