Compliance Terms
& Frameworks
We operate under a rigorous compliance framework spanning data protection, industry regulations, and international standards. Here’s our commitment to you and what we need from you in return.
Scope & Purpose
These Compliance Terms ("Compliance Terms") form an integral part of the agreement between Exponent Solutions Pvt. Ltd. ("Exponent") and its clients. They define the regulatory compliance obligations, frameworks, and responsibilities that govern the delivery of Exponent’s services.
These terms apply to all service engagements involving data processing, cloud infrastructure, software development, AI/ML implementation, and managed services. Both parties acknowledge that compliance is a continuous obligation and not a one-time certification event.
Purpose of These Terms
Compliance Frameworks
Exponent’s compliance program is built on internationally recognized frameworks and independently verified through third-party audits. Our active certifications and compliance postures include:
SOC 2 Type II
AICPA Trust Services Criteria
Annual audit covering Security, Availability, Processing Integrity, Confidentiality, and Privacy trust service criteria. Reports available to clients under NDA.
ISO 27001:2022
Information Security Management
Full ISMS certification covering information security policies, risk management, asset management, access control, and incident management processes.
PCI DSS Level 1
Payment Card Industry Standard
Highest level PCI DSS compliance for services involving payment card data processing, storage, or transmission on behalf of financial services clients.
HIPAA Readiness
Health Insurance Portability Act
HIPAA-ready infrastructure and processes for healthcare clients. BAA (Business Associate Agreement) available for all engagements involving Protected Health Information.
GDPR & PDPA
EU & India Data Protection
Full GDPR compliance for EU data subjects and Digital Personal Data Protection Act (PDPA) 2023 compliance for Indian data subjects. DPA available on request.
ISO 9001:2015
Quality Management System
Quality management certification ensuring consistent service delivery processes, customer satisfaction measurement, and continuous improvement practices.
Data Privacy Laws
Exponent processes personal data as a data processor on behalf of its clients. Our obligations under applicable data protection laws are formalized through Data Processing Agreements (DPAs) which are available for execution alongside your service agreement.
General Data Protection Regulation (GDPR)
We act as a data processor under Art. 28 GDPR. Standard Contractual Clauses (SCCs) are executed for all international data transfers. Data subject rights requests are fulfilled within 30 days. A DPA is mandatory for all EU client engagements.
Digital Personal Data Protection Act 2023 (DPDPA)
Exponent complies with all obligations applicable to Data Fiduciaries and Data Processors under the DPDPA. We maintain records of processing activities and implement appropriate technical and organizational measures as required.
CCPA / State Privacy Laws
For clients with California residents’ data, we comply with CCPA/CPRA requirements as a Service Provider. We do not sell personal information and provide required contractual terms limiting our use of personal data.
Cross-Border Data Transfer Safeguards
All international data transfers are governed by appropriate transfer mechanisms including SCCs, Binding Corporate Rules, or adequacy decisions. Clients are informed of data residency options before service commencement.
Shared Responsibilities
Compliance under a shared services model requires clear delineation of responsibilities. The following matrix defines who is primarily responsible for each compliance activity:
| Compliance Activity | Exponent | Client | Shared |
|---|---|---|---|
| Infrastructure security controls | PRIMARY | — | — |
| Data classification before ingestion | — | PRIMARY | — |
| Regulatory reporting to authorities | — | PRIMARY | — |
| End-user access management | — | PRIMARY | — |
| Data subject rights fulfilment | Support role | PRIMARY | — |
| Breach notification (to regulators) | Support role | PRIMARY | — |
| Breach notification (to Exponent) | — | PRIMARY | — |
| Vendor risk management | — | — | SHARED |
| Employee training on compliance | — | — | SHARED |
| Audit facilitation & evidence | — | — | SHARED |
| Platform & application security | PRIMARY | — | — |
| Client-side device security | — | PRIMARY | — |
Important: Client as Data Controller
Industry Regulations
For clients in regulated industries, Exponent maintains additional compliance postures aligned to sector-specific requirements. These are activated based on the nature of your engagement:
🏭 Industry-Specific Compliance Postures
Financial Services
RBI IT Framework, SEBI guidelines, Basel III controls support, AML/KYC integration standards, and PCI DSS for payment processing.
Healthcare
HIPAA/HITECH BAA available, HL7 FHIR R4 interoperability, clinical data security standards, and support for NABH digital health frameworks.
Government & Public Sector
MEITY cloud policy compliance, NIC security standards, GeM procurement alignment, and support for GovStack framework requirements.
Retail & E-commerce
Consumer Protection Act 2019 compliance, e-commerce rules adherence, PCI DSS for payment processing, and data localization support.
Manufacturing
OT cybersecurity compliance, IEC 62443 standards awareness, product safety data handling, and supply chain compliance documentation.
Telecom & Technology
TRAI regulations awareness, IT Act 2000 compliance, CERT-In compliance including incident reporting within 6 hours per mandate.
Compliance Reporting
Exponent provides clients with the documentation and evidence needed to support your own compliance programs, regulatory audits, and due diligence requirements.
- ✓SOC 2 Type II reports available under NDA upon written request
- ✓ISO 27001 certificate available for download from our compliance portal
- ✓Annual compliance summary letter provided to Enterprise clients each January
- ✓Penetration test executive summary available to clients on request
- ✓Sub-processor list maintained and updated with 30 days notice of changes
- ✓Data Processing Impact Assessment (DPIA) support available for high-risk processing activities
- ✓CERT-In incident reports filed within 6 hours for applicable incidents as required by Indian regulations
Compliance Portal Access
Breach & Violation Protocol
In the event of a compliance violation — whether a data breach, regulatory non-conformance, or policy violation — both parties must follow the notification and remediation protocol below.
Exponent’s obligations upon discovering a compliance violation:
- ✓Notify Client within 72 hours of becoming aware of any personal data breach affecting Client Data
- ✓Provide initial incident assessment including scope, categories of data affected, and approximate number of individuals
- ✓Provide reasonable cooperation and assistance to Client for Client’s own regulatory notifications
- ✓Implement containment measures and document remediation steps taken
- ✓Deliver full post-incident report within 15 business days of incident closure
Client’s obligations upon discovering a compliance issue:
- ✓Notify Exponent within 24 hours of discovering any potential breach or compliance issue involving Exponent systems
- ✓Cooperate fully with Exponent’s investigation and not take unilateral remediation actions in Exponent-managed environments
- ✓Retain independent legal counsel for regulatory notification decisions — Exponent cannot provide legal advice
CERT-In Mandatory Reporting
Sub-Processor Compliance
All sub-processors engaged by Exponent to process Client Data are subject to the same compliance obligations as Exponent under these terms. Exponent maintains a formal sub-processor management program that includes:
- ✓Pre-engagement compliance assessment for all new sub-processors handling Client Data
- ✓Annual compliance reassessment for all active sub-processors
- ✓Data Processing Agreements with all sub-processors containing equivalent protections to those in Client DPAs
- ✓Contractual right to audit sub-processors where required by applicable regulations
- ✓30 days advance notice to Clients before engaging new sub-processors with access to their data
Regulatory Changes
The regulatory landscape is constantly evolving. Exponent maintains a regulatory change management process to monitor, assess, and respond to new and updated laws, standards, and guidelines that affect our services.
When a material regulatory change occurs that affects Client obligations or Exponent’s service delivery, Exponent will notify affected clients within 30 days of the change becoming effective (or as soon as reasonably practicable where the change has immediate effect). Exponent will provide reasonable guidance on the impact to your services but cannot provide legal advice — you should consult your legal counsel regarding any regulatory changes affecting your business.
Compliance Contact
For all compliance-related enquiries, requests for audit documentation, DPA execution, or regulatory questions related to Exponent’s services, please use the following contacts:
Compliance Team
For audit reports, DPAs, certifications
compliance@exponentsolutions.ai Response within 5 business days
Legal Team
For contract terms, DPA negotiation
legal@exponentsolutions.ai Response within 5 business days
Data Protection Officer
For data subject rights, GDPR queries
dpo@exponentsolutions.ai Response within 5 business days
Incident Hotline
For active breaches or incidents
security@exponentsolutions.ai +91 01234 4333534 (24/7)
Our registered Data Protection Officer for GDPR purposes: compliance@exponentsolutions.ai. Registered address: A-33, Raheja Vedaanta, Sector 108, Gurugram, Haryana 122017, India.
Need Compliance Documentation?
Request our SOC 2 reports, ISO certificates, DPA templates, and compliance questionnaire responses — our team will respond within 5 business days.