Security Terms
&Obligations
Our security commitments are not buried in legal language. Here is exactly what we do to protect your data, what we expect from you, and how we handle incidents.
Scope & Applicability
These Security Terms form part of the Master Service Agreement or applicable Order Form between Exponent Solutions Pvt. Ltd. and the Client. They define the security obligations of both parties for delivery of Exponent services, platforms, and consulting engagements.
These terms apply to all service engagements that involve processing, storage, transmission, or access to Client Data, including cloud infrastructure, software development, AI and ML deployments, SaaS integrations, and managed IT operations.
Who This Applies To
Covered entities
All clients with active agreements involving data processing, cloud infrastructure, or managed services.
What Is Covered
Security boundary
All environments managed or accessed by Exponent, including cloud, on-prem, and hybrid components.
Legal Relationship
Contract hierarchy
These terms supplement your MSA. In case of conflict, MSA terms prevail unless explicitly overridden.
Jurisdiction
Applicable law
Governed by Indian law with jurisdiction in Gurugram, Haryana, subject to applicable transfer regulations.
Important Notice
Our Security Obligations
Exponent maintains enterprise-grade controls across all service delivery environments and continuously improves safeguards through review, testing, and audit programs.
Technical Security Controls
Encryption at Rest & Transit
AES-256 encryption for stored data and TLS 1.3 for data in transit.
Network Security
Firewall, WAF, DDoS mitigation, and network segmentation across environments.
24/7 Monitoring
Continuous SOC monitoring with automated threat detection and alerting.
Vulnerability Management
Frequent vulnerability scanning, patching, and periodic penetration testing.
Backup & Recovery
Automated backups with geo-redundancy and documented recovery objectives.
Secure SDLC
OWASP-aligned SDLC with code reviews and security scanning in CI pipelines.
- ✓Maintain SOC 2 Type II certification with annual third-party audits
- ✓Conduct annual ISO 27001 recertification assessments
- ✓Provide clients with security reports and summaries upon request
- ✓Train all staff with data access on security practices at least annually
- ✓Maintain dedicated security operations capability with incident escalation
- ✓Run background verification for personnel with production access
Your Security Obligations
Security is a shared responsibility model. While Exponent secures platform and infrastructure layers, clients must maintain baseline controls in their own environment and user operations.
Shared Responsibility Model
Credential & Access Management
Enforce strong password policy, MFA for privileged users, and immediate deprovisioning for departing employees.
Incident Reporting
Report suspected security incidents to security@exponentsolutions.ai within 24 hours of discovery.
Client Endpoint Security
Keep endpoint OS and security patches current for all systems accessing Exponent environments.
Data Classification
Classify data before sharing and avoid uploading data outside approved sensitivity scope.
Security Awareness Training
Ensure business users complete annual awareness training to reduce human-factor risks.
Quarterly Access Reviews
Review user access regularly and maintain least-privilege assignments across teams.
Data Protection
Exponent classifies and handles Client Data according to a strict data protection framework. Controls are enforced by data category and processing context.
| Data Classification | Examples | Encryption | Access Level | Retention |
|---|---|---|---|---|
| Highly Confidential | PII, financial records, health data | AES-256 + HSM | Need-to-know only | Per DPA |
| Confidential | Business logic, API keys, credentials | AES-256 | Authorized team only | Term + 90 days |
| Internal | Project docs, service config | TLS in transit | Project team | Term + 30 days |
| Public | Marketing assets, public APIs | Standard | Unrestricted | Indefinite |
On service termination, all Client Data classified as Confidential or higher is securely deleted in line with contractual and regulatory obligations. Certificate of deletion is available on request.
Data Portability
Incident Response
Exponent maintains a documented Incident Response Plan with defined timelines, ownership, and communication channels. Response obligations are aligned to severity tiers.
Active Breach / Data Exfiltration
Containment starts immediately. Client notification is prioritized and regulatory coordination follows legal requirements.
Unauthorized Access Attempt / Service Disruption
Rapid triage, controlled remediation, and a formal incident report after root-cause analysis.
Vulnerability Discovery / Policy Violation
Investigation and fix planning with tracked ownership and security governance review.
Security Non-Conformance
Addressed in normal security maintenance windows with closure evidence.
Incident Reporting Channel
Access Control
Access to production systems and Client Data is governed by least-privilege policy, role-based controls, and identity assurance standards.
- ✓Production access requires MFA for all users with elevated rights
- ✓Role-based access control enforced with periodic access review
- ✓Privileged sessions monitored and audited
- ✓All access events logged and retained for audit requirements
- ✓Access revoked promptly after role change or offboarding
- ✓Time-bound access used for sensitive operational tasks
Clients may request access logs for environments processing their data, subject to contractual and compliance constraints.
Security Audits
Exponent undergoes regular external security assessments and maintains formal audit programs to validate controls and operational effectiveness.
SOC 2 Type II
Annual independent audit
Annual audit covering Security, Availability, and Confidentiality controls. Reports available under NDA.
ISO 27001
ISMS certification
Information Security Management System certification with annual recertification and periodic surveillance audits.
Penetration Testing
Third-party testing
Annual third-party penetration testing by accredited teams. Executive summary available to enterprise clients.
Client-Initiated Audits
Right to audit support
Enterprise clients may request right-to-audit with prior notice, NDA, and reasonable scheduling requirements.
Third-Party Vendors
Exponent maintains a vendor risk management process. Sub-processors with access to Client Data are assessed against baseline security requirements before onboarding and reviewed regularly.
Clients are informed ahead of material sub-processor changes where required by contract or data processing agreements.
Sub-Processor Objection Rights
Liability & Remedies
Liability for security incidents is governed by applicable agreement terms, including limits, exclusions, and service credit provisions.
- ✓Exponent maintains professional and cyber liability coverage
- ✓For incidents attributable to Exponent negligence, reasonable breach response cooperation is provided
- ✓Service credit remedies may apply based on agreed SLA commitments
Limitation of Liability
Updates to These Terms
Exponent reviews these Security Terms at least annually and may update them to reflect legal changes, industry standards, and security best practices.
- ✓Email notification to primary account contacts before material changes
- ✓In-product or portal update notices where relevant
- ✓Published version history with effective dates
Continued use of services after the effective date of updated terms indicates acceptance. For questions, contact legal@exponentsolutions.ai before the update takes effect.
Questions About Our Security?
Our security and legal teams are available to discuss these terms, provide audit reports, and answer questions about how we protect your data.