Security

How AMT protects your code, data and systems

AMT runs an information security management system certified to ISO 27001. Your code lives in your repository, our engineers work through accounts you control, and personal data from the EU moves only under the 2021 Standard Contractual Clauses. This page answers the questions your security team will ask, before they ask them.

Request the security pack

Certificates, policies and a completed questionnaire, sent by a named person.

The security questionnaire, answered in public

These are the questions that appear in almost every vendor security review. Your team can check our answers before the first call.

The security questionnaire, answered in public
Question	AMT's answer
Is AMT certified to ISO 27001?	Yes. Certificate details are on /about/certifications-compliance
Where does our code live?	In your repository, in your organisation's account, from day one
Where will our data be processed?	In your environment by default. Engineers work in India (Bengaluru and Kochi) through access you grant and can revoke
Do engineers access production data?	Only when the task requires it, with your written approval, through named accounts. Test environments use masked or synthetic data
Is our code used to train AI models?	No. Only AI tools on business plans that do not train on customer code are allowed
When access ends, how is it removed?	All access is revoked at the end of the engagement or when an engineer leaves the project, and you get the access log

Request the security pack

Certificates, policies and a completed questionnaire, sent by a named person.

If you are ISO 27001 certified, here is your evidence for control 8.30

ISO 27001:2022 control 8.30 says your organisation must direct, monitor and review any software development you outsource. Your auditor will ask how you did that for AMT. We give you the evidence as standard.

Evidence for ISO 27001 control 8.30
What your auditor asks for	What AMT provides
Security requirements agreed before work started	A security schedule in the contract: secure coding standard, testing requirements, remediation timelines
Right to audit	An audit clause in the contract
Secure coding in practice	Pull request reviews with named approvers, and automated code scanning in the pipeline
Security testing before acceptance	Test results attached to each increment and the production readiness gate
Least-privilege access	Named accounts, scoped to the repositories and systems the work needs, with start and end dates
Access removed at the end	A signed access revocation record
Supplier assessment	This page, our certificate and the completed questionnaire

EU and UK personal data

India does not have an EU adequacy decision, so personal data from the EEA can only reach India with a safeguard. Here is how AMT handles it.

Standard Contractual Clauses (2021). Module 2 when you are the controller and AMT processes on your instructions. Module 3 when AMT is a sub-processor under your processor.
Transfer impact assessment. We give you the information you need on Indian law to complete yours, including government access powers and the CERT-In directions.
Keep data out of India where you can. Most engagements do not need personal data to leave your environment at all. Engineers work inside your cloud, through your access controls.
Data processing agreement. Signed before any personal data is touched.

Indian rules your security team should know about

Indian rules your security team should know about
Rule	What it means for your project
CERT-In Directions, 28 April 2022	As an Indian IT service provider, AMT must report listed cyber incidents to CERT-In within 6 hours and keep ICT logs for 180 days inside India. Your incident plan should expect that report
Digital Personal Data Protection Act 2023 and Rules 2025	Rules notified 13 November 2025, most obligations from 13 May 2027. Section 17(1)(d) exempts Indian companies processing the data of people outside India under a foreign contract from most core obligations. Your GDPR terms govern instead

This is general information, not legal advice. Your counsel should confirm how it applies to your contract.

How we build securely

Secure design at the architecture gate. Authentication, authorisation, data flows and secrets handling are agreed before code is written.
Reviewed code only. Nothing merges without a named reviewer. Security-sensitive code is written or rewritten by a senior engineer, never accepted from an AI tool as generated.
Secrets never in code. Credentials live in your secrets manager, never in the repository.
Production readiness gate. Monitoring, logging, rollback and access are checked and signed before go-live.

FAQ

Is AMT ISO 27001 certified?

Yes. Full details, including how to verify the certificate, are on /about/certifications-compliance.

Is it safe to outsource software development to India?

It can be, when the controls are written into the contract and checked. Ask for an ISO 27001:2022 certificate you can verify, Standard Contractual Clauses for EU data, named-account access you control, and evidence of code review. AMT provides all four.

Can EU personal data be processed in India under GDPR?

Yes, with a safeguard. India has no EU adequacy decision, so transfers use the 2021 Standard Contractual Clauses and a transfer impact assessment. Many projects avoid the transfer altogether by keeping data inside the client's environment.

Do AMT engineers work on our systems or theirs?

On yours, through accounts you create and can revoke. Code lives in your repository.

What happens to our data when the project ends?

Access is revoked, any copies are deleted, and you get a written confirmation.

Does AMT use AI tools on client code?

Only approved tools on business plans that do not train on customer code, and never on security-sensitive code without a senior engineer rewriting it. You can opt out entirely.

Tell us what your security review needs. We will send the pack and put you in touch with the person who maintains our ISMS.

See our certificates →