For terms not defined herein, please refer to our Terms of Service and Privacy Policy

This document applies our Cloud products Wealth.Assyst, 888hr.ai and TT Online (“Cloud Products”) and our hosted product TT Payroll SafeHost (“Hosted Products”).

Frequently Asked Questions on Tekk.ai Ltd‘s, and its wholly owned subsidiaries, Security Policies.

Where is my data stored?

Our production applications are currently hosted on in the United Kingdom and the Channel Islands. 

Will your personnel have access to customer data and what data will they have access to?

For our Cloud Products: Ordinarily, our personnel do not have the ability to access your data. In limited circumstances, in order to provide you technical support, we could access your data. Such access will need to be specifically approved and will be with your consent. Even, in these circumstances access to your data will be restricted to a small number of personnel on a need-to-know basis. This access is also reviewed periodically.

For our Hosted Product: We retain an admin user for each account which can access the account data. We do so in limited circumstances, in order to provide you technical support. Access to your data will be restricted to a small number of personnel on a need-to-know basis. This access is also reviewed periodically.

Is data stored on your Cloud Products encrypted?

In our Cloud Products, we encrypt sensitive personally identifiable information in customer data both in transit and at rest. All customer data is encrypted in transit over public networks using Transport Layer Security (TLS) 1.2/1.3 with Perfect Forward Secrecy (PFS) to protect it from unauthorized disclosure or modification.

In our Hosted Products, the data at rest is encrypted as per MS Access tools. Security is hardened through incremental measures such as RDP access and NTFS implementation

How are passwords for your cloud services stored?

The passwords customers use to access Services are stored in a non-reversible encryption scheme.

How is customer data segmentation implemented in your cloud services?

Our framework distributes and maintains the cloud space for our customers. Data of multiple customers is logically separated from each other and our framework ensures that no customer’s service data becomes accessible to another customer.

How do you protect yourself against DDos attacks?

As our services are hosted on reputable cloud providers, we benefit from their state-of-art protection against DDoS.

If I found a vulnerability in one of your products, how do I report it?

If you discover a vulnerability in one of our products, you can let us know so that we can fix it as soon as possible at contact-us@tekk.ai.

Do you have an incident response program?

In cases where we are controllers of data and an incident leads to a data breach, the affected customers will be notified within 72 hours after we become aware of it.  In cases where we are processors of data and an incident leads to a data breach, the respective controllers will be informed without undue delay. 

For general incidents, we will notify users through our website, blogs, forums, and social media. For incidents specific to an individual user or an organization, we will notify the concerned party through email (using their primary email address). A complete report can be provided to customers on request within 5 to 7 working days.

What are your responsibilities in the event of a security incident?

We notify the incidents that apply to you, along with suitable actions that you may need to take. We track and close the incidents with appropriate corrective actions. Whenever applicable, we provide you with necessary evidences regarding incidents that apply to you. Root Cause Analysis will be provided on request.

As a customer, what are the additional security options I have to protect my data?

Additional security features that can be availed by customers:

• Multi factor authentication
• Role based access control

If a customer discontinues a Service, how long is their data retained?

We hold the data in your account as long as you choose to use our Services. Once you terminate your user account or it gets terminated by us, your data will be removed or anonymised within 180 days. The data deleted from the active database will be deleted from backups 30 days thereafter.

What is your business continuity and disaster recovery plan?

We have a business continuity plan for our major operations such as support and infrastructure management. 

What is your data backup policy?

We run full back-ups at least once a week and incremental (or full) back-ups every day. Back-up data in a data centre is stored in the same location and encrypted at rest, as the original data. A retention time of 30 days is applicable for all backed up data. 

What controls do you have in place while accessing customer data?

We employ technical access controls and internal policies to prohibit employees from arbitrarily accessing user data. We adhere to the principles of least privilege and role-based permissions to minimize the risk of data exposure.  

What is your risk assessment process? How often is risk assessment performed?

We have a risk assessment policy and procedure to identify, analyse and mitigate risks by implementing appropriate controls. We perform risk assessments for every major change that happens in our environment. The overall risks are reviewed and updated at least once in a year. 

Will you share my data for the purpose of law enforcement?

We always place the utmost importance to our customers’ privacy. When we receive requests from law enforcement authorities, we review such requests to see if the applicable legal process has been followed to obtain a valid and binding order. We object to overboard or otherwise inappropriate requests. Unless prohibited by law, we notify customers before disclosing customer data so that the customers can seek protection from disclosure.