Trust centre
How we look after your data.
Everything a security reviewer or procurement team asks before signing, in one place: where data lives, who can reach it, the contract terms, and what we do and do not hold.
Last reviewed 22 October 2026. Questions: hello@smallbaydigital.com
Four commitments, in every statement of work
- Your systems live in your accountsWe build on platforms you own, in your name, from day one. Your data stays where you put it, in the region you chose.
- Our access is scoped and revocableEngineers work through roles in your accounts, limited to what the build needs. You can see and remove that access in one click.
- Keys never sit in codeCredentials live in an encrypted store, one per connection, and are rotated at handover or whenever you ask.
- We do not train on your dataYour data is never used to train models, by us or by the AI providers we use under their commercial terms.
Documents
- Security and dataWhere data lives, who can access it, how keys and logs are handled, and what happens at handover.
- Sub-processorsEvery provider that may process personal data for us, what for, and where.
- Data processing addendumOur standard processor terms, with transfer safeguards for the UK, EU and India.
- Privacy noticeHow this website and our sales process use personal data, and how long we keep it.
Certifications and frameworks
We are a small company and we would rather be exact than impressive. This is our status today.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | Not held | Not held. We share our security practices and answer security questionnaires instead. |
| ISO/IEC 27001 | Not held | Not held. |
| GDPR and UK GDPR | Applies | We act as a processor under a written data processing addendum, with Standard Contractual Clauses or the UK Addendum for transfers. |
| India DPDP Act 2023 | Applies | We transfer personal data only to countries not restricted by the Government of India. |
Need a security questionnaire completed? Send it to hello@smallbaydigital.com and we return it within five working days.
Company details
- Legal nameSmallBay Digital LLP
- Legal formLimited liability partnership registered in India
- Registered officeWeWork Galaxy, 43 Residency Road, Bengaluru 560025, Karnataka, India
- Governing lawLaws of India; courts of Bengaluru, unless a signed contract says otherwise
- Contacthello@smallbaydigital.com
Report a security issue
If you think you have found a vulnerability in our website or in a system we built, email hello@smallbaydigital.com with the subject "Security report". We acknowledge within two working days, keep you informed, and do not take legal action against good-faith research that avoids harm to people and data.