Headx is certified under ISO/IEC 27001:2022 (information security management) and SOC 2 Type I (trust services criteria). The certificate and audit report are available from sales on request.
1 Data protection
Encryption in transit
Traffic between the Headx agent, the dashboard and the backend uses HTTPS with TLS 1.3. HSTS is enforced with a one-year max-age on customer-facing endpoints.
Data at rest
Cloud data — the database, screenshots and recordings — is stored on the Headx server in Mumbai and never leaves India. Passwords and agent API keys are stored only as bcrypt hashes. On-Premise installations keep all data on the customer's own server, protected by the customer's disk encryption and access controls.
Secrets
Database credentials and signing keys live in server-side environment files outside the web root. They are never sent to the browser or to the agent.
2 Data residency
Cloud: All Headx Cloud data is hosted in a Mumbai, India data centre. No replication outside India; daily database backups also stay in India.
On-Premise: Data resides exclusively on customer infrastructure. Headx engineers access On-Premise systems only when the customer grants access, and we hold no copy of customer data.
This satisfies the data-localisation requirements of the RBI Master Direction on IT Outsourcing, IRDAI Information and Cyber Security Guidelines, and the SEBI Cybersecurity Framework.
3 Access controls
Customer-side
Role-based access control with five built-in roles (Super Admin, IT Admin, HR Manager, Department Head, Read-only) and the ability to define custom roles with their own permissions. Sign-in is rate-limited and sessions expire after 2 hours. Multi-factor authentication for customer accounts is on the roadmap and is not available today.
Headx-side
Headx staff administer the service through a separate platform console that supports two-factor authentication (TOTP). Actions taken there are recorded in an audit log.
4 Agent (endpoint) security
The Windows agent:
- Authenticates with its own API key, issued at enrolment and stored hashed on the server
- Talks to the backend over HTTPS only
- Resists tampering — the service restarts itself if stopped, its settings are locked against standard users, and uninstalling requires a password set in the dashboard
- Queues events while the PC is offline and sends them when the connection returns
- Is distributed as an MSI that is not yet code-signed; SHA-256 hashes are available on request for allow-listing, and code signing is on the roadmap
See Security Architecture for the full technical breakdown.
5 Compliance frameworks
India statutory
| Framework | Status | Notes |
|---|---|---|
| IT Act 2000 (Section 43A) + 2008 amendment | Aligned | Reasonable security practices implemented |
| IT (Reasonable Security Practices) Rules 2011 | Aligned | Consent, notice, retention, breach reporting |
| DPDP Act 2023 | Aligned | Granular consent flags ship today. Full status |
Sector-specific
| Framework | Sector | Status |
|---|---|---|
| RBI Master Direction on IT Outsourcing (Apr 2023) | Banks / NBFC | Aligned |
| RBI Cyber Security Framework for Banks (Jun 2016) | Banks | Aligned |
| IRDAI Information & Cyber Security Guidelines (2017) | Insurance | Aligned |
| SEBI Cybersecurity & Cyber Resilience Framework (Aug 2022) | Capital markets | Aligned |
| NDHM / DISHA (draft) | Healthcare | Incorporated |
International certifications
| Framework | Status | Scope |
|---|---|---|
| ISO/IEC 27001:2022 | Certified | Information security management system. Certificate details |
| SOC 2 Type I | Certified | Trust services criteria audit |
| GDPR (Article 28 DPA) | Available | For EU-HQ customers with Indian operations |
6 Reporting a vulnerability
If you discover a security vulnerability in Headx, please report it to info@headx.in with:
- A description of the issue and reproduction steps
- Affected endpoint or page
- Severity assessment (your view)
- Any proof-of-concept code (please do not include real customer data)
What to expect
We acknowledge every report, keep you updated until the issue is fixed, and credit you publicly on request once the fix is live. Please allow reasonable time for a fix before public disclosure.
7 Incident response and notification
Headx commits to:
- Customer notification — affected customers notified within 72 hours of a confirmed incident involving their data (DPDP Act 2023 alignment)
- CERT-In — reporting within 6 hours, per the 28 April 2022 directive
- Post-incident summary — shared with affected customers once the incident is resolved
8 Sub-processors and data flows
For Cloud customers, the following sub-processors handle data on our behalf:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger International | Cloud server: application, database, file storage and email | Mumbai, India |
| Cashfree Payments | Payment processing | India |
| Razorpay | Payment processing | India |
| Stripe | Card payments for international customers | Global |
On-Premise customers have no Headx sub-processors — all data flows are inside the customer's own infrastructure.
9 Audits and assurance
Available to customers under NDA on request:
- ISO/IEC 27001:2022 certificate and SOC 2 Type I report
- Security questionnaire responses (SIG, CAIQ, customer-specific)
- Data Processing Agreement (DPA) signed by our authorised signatory
- Sub-processor list
Related documents
- Security Architecture — full technical security documentation
- DPDP Act 2023 Status — granular compliance posture
- ISO 27001 Certification — certificate & scope
- Employee Monitoring Laws in India — legal framework guide
- Privacy Policy — how we handle personal data
Request via info@headx.in.
Need detailed audit evidence or a signed DPA?
The full Statement of Applicability, latest penetration-test summary, sub-processor register with annual review records, and pre-filled CAIQ / SIG questionnaires are available under NDA — typically within 24 hours (IST business days).