Written for the person who has to sign this off
Scoped access you grant and revoke, data that stays in your systems, and a certification status we state honestly rather than badge.
- Your systems, your access controls
- Named sub-processors
- DPA available unsigned, without an NDA
What we hold today, stated plainly
We are a new firm. Pretending otherwise to a security reviewer is the fastest way to fail a review, so here is the real position.
ISO 27001 alignment is in progress: the controls are being implemented and documented, and we are not yet certified. SOC 2 Type II is on the roadmap and no audit period has begun. Neither badge appears anywhere on this site, because we do not hold them.
What we can give you today is the substance a certificate is supposed to evidence: scoped access, named sub-processors, a signed DPA, documented segregation of duties, and a written answer to any questionnaire you send. If your policy requires a certificate before you can contract, tell us on the first call and we will say honestly whether we can meet it.
Which legal entity is certified, and what does the audit scope actually cover? A badge on a website tells you nothing without both answers. Ask us the same two.
- ISO 27001
- Alignment in progress, not certified
- SOC 2 Type II
- On the roadmap, no audit period started
- GDPR / UK GDPR
- DPA available, SCCs and IDTA supported
- Other regimes
- PIPEDA, Australian Privacy Principles, Saudi PDPL
- Sub-processors
- Published in full, 30 days' notice of change
- Delivery
- India and the Middle East
The six things a reviewer usually asks about
In the order they tend to come up on a security call.
01You grant and revoke access
Access is scoped by you, granted to named individuals, and removed through your own joiner-leaver process. We never hold a shared account.
- 02
Nobody here can move money
We prepare and route; you approve and release. Any change to a supplier's bank details is escalated to you for out-of-band verification, never actioned by us.
03Your data stays in your systems
We work inside your ERP rather than copying data out. Where a copy is unavoidable, the storage region is written into the DPA.
Read the DPA
04Every sub-processor is named
The list is published, not available on request, and you get at least 30 days' notice before anything is added to it.
See the list
05Segregation of duties
The analyst who maintains a supplier's master data is never the analyst who processes that supplier's invoices. Duplicate detection runs before approval routing.
06A trail your auditors can follow
Every step leaves documentation in your own systems, indexed so an audit does not become a reconstruction exercise.
Where your data is, and what covers the transfer
We deliver from India and the Middle East and say so plainly rather than describing ourselves as global.
Because we work inside your systems, most personal data never leaves them — our analysts access it rather than receive it. Where a transfer does happen, the UK International Data Transfer Agreement and the EU standard contractual clauses cover transfers to India, and the storage region is named in the DPA rather than left to our discretion.
Our team works from Procuriva FZE LLC in Ajman, United Arab Emirates, and Procuriva Private Limited in Bengaluru, India. Both entities are named in the privacy policy, because a data subject is entitled to know which company processes their data and where.
Send it to legal@procuriva.com and we will complete it in your format rather than returning a PDF of our own. We will also send the DPA unsigned, without requiring an NDA first, so your counsel can read it before you commit to anything.
- Processing locations
- India and the United Arab Emirates
- UK transfers
- International Data Transfer Agreement
- EU transfers
- Standard contractual clauses
- Storage region
- Named in the DPA, not left open
- Data copied out
- Avoided by design; we work in your systems
- Questionnaires
- Completed in your format
Frequently asked questions
What IT, security and legal reviewers ask before approving an offshore provider.
Send us the questionnaire before you send us a brief.
We would rather your security team cleared us early than discovered a blocker after the commercial conversation. Ask for the DPA and the sub-processor list at the same time.
Book a free spend auditlegal@procuriva.com — we reply within two working days.