SECURITY & GOVERNANCE
Data Stored in IndiaSecurity built on architectural clarity, not vague badges.
Enterprise buyers care about specifics: where data lives, how permissions isolate external users, and whether AI agents can leak confidential records across departments. Here is exactly what is true today, and what is currently in audit.
Stored in India
Data Residency
AWS Mumbai, backups in Hyderabad
100%
Customer Data Ownership
Export in open formats anytime
0
Cross-Tenant Leakage
Strict workspace boundary isolation
Dec 2026
SOC 2 Type II Target
Audit currently underway
LIVE COMMITMENTS
What is True in Production Today
Six verifiable architectural facts backing every Methodical deployment.
Indian Cloud Infrastructure
Your data is stored in India. When you use an AI feature, the content of that request is processed by an AI model provider, which may be outside India.
100% Customer Ownership
You own your data completely. Full open-format export (Postgres schema dumps, JSON, CSV, raw audio WAVs) available at any time with zero exit penalties.
ACL-Aware Retrieval
AI agents inherit the requesting user's exact permissions. An agent will never query, summarize, or surface records the asking user cannot open directly.
Rest & Transit Encryption
TLS 1.3 in transit with strict HSTS, and AES-256 encryption at rest across all Postgres databases, vector stores, and object buckets.
DPDP Act 2023 Aligned
Designed from day one for Indian personal data protection standards. Dedicated Data Protection Officer (DPO) and structured rights fulfillment channels.
Published Sub-Processors
Published sub-processor registry with audited DPAs. No unvetted third-party tracking or session recording tools on customer data surfaces.
ARCHITECTURAL DIFFERENTIATOR (§5.4.1)
Set up in minutes. Detailed enough to survive an audit.
Enterprise access control usually fails in one of two directions: too simple to govern a real organization, or so complex that configuring it requires consulting. Methodical is deliberately both.
Teams & Base Roles
Team Admin and Team Member roles governing Boards, Switchboard, Smart Tables, and Drive folders. Shared Drive folders add simple Editor and Viewer permissions. An ops lead gets started without meeting a permissions matrix.
Enterprise App Roles
Arbitrarily rich roles scoped inside each Enterprise App (e.g. SalesNet Area Manager vs. Field Rep vs. Finance Lead). Granular field-level and action-level controls satisfy compliance officers.
Isolation Boundaries
Group Boards, Smart Tables, Switchboard, and People into a Workspace isolated from everything else. The answer to "can we let our external distributor or contractor in without them seeing anything else?"
Agents inherit the requesting user's exact permissions.
The single biggest enterprise objection to agentic AI is data leakage across departments. In Methodical, our retrieval layer is ACL-aware rather than merely embedding-similar. An agent answering a field rep's prompt queries only what that specific rep is entitled to see across team memberships, app roles, and workspace boundaries.
The AI model is a policy setting, not an architectural decision.
Choose the model per agent. Swap it without rebuilding anything. If your policy requires it, an agent can run on a local, private or open-weight model instead. It is a configuration toggle, not a code rewrite.
Zero model obsolescence in practice: foundation model migrations execute seamlessly in the background with zero customer downtime or retraining required.
AUDIT & CERTIFICATION
Honest Certification Roadmap
We state certification timelines openly rather than claiming unearned compliance badges.
SOC 2 Type II — audit underway, certification expected in December 2026.
We are currently in the formal observation and audit period for our SOC 2 Type II attestation report with an accredited independent CPA firm. We will publish the final attestation report directly on this page upon completion in December 2026.
• Scope: Security, Availability, and Confidentiality Trust Services Criteria
• Infrastructure Scope: AWS Mumbai (backups in AWS Hyderabad)
• NDA-backed interim security pack available for enterprise procurement teams.
DPDP ACT 2023 REDRESSAL
Data Principal Rights & Grievance Mechanism
Under the Digital Personal Data Protection Act 2023, data principals have the right to access, correct, and request erasure of their personal records.
Designation: Privacy & Compliance Lead
Legal Entity: RedBlackTree Technologies Pvt. Ltd.
Email: privacy@methodical.ai
Address: Chennai, India
Response timeline: Acknowledged within 24 hours, resolved within 72 hours.
Grievance Lead: Grievance Redressal Officer
Desk Email: grievance@methodical.ai
Rights Scope: Access, Correction, Erasure, Consent Withdrawal
Requests are processed in accordance with the provisions of DPDP Act 2023.