FireAI protects your data with enterprise-grade controls, transparent processes, and continuous third-party validation.
FireAI has been independently assessed against Regulation (EU) 2016/679 — General Data Protection Regulation. Examination dated 19 May 2026.
“Adequately designed and implemented controls to meet the requirements of GDPR.”
Privacy notice published, cookie consent banner, granular consent capture, withdrawal mechanism, and a maintained consent log.
ROPA, data inventory, purpose limitation, minimization, retention timelines, and anonymization of personal data attributes.
Access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making.
Access restriction, encryption at rest and in transit, periodic VAPT, WAF, audit logging, and timely security updates.
Documented roles, data protection policy, periodic training, monitoring & review, ROPA, DPIA, and prior consultation.
Change management approvals, environment segregation (dev / test / prod), and no production data used in testing.
DPO appointed, independent, reporting to top management, with the resources, training and expertise to act.
Data Processing Agreements executed with all third parties; integrations expose only the minimum personal data required.
Transfers protected by Standard Contractual Clauses, adequacy decisions, and approved codes of conduct.
FireAI operates as a data processor on behalf of its customers (data controllers). Purpose, scope, and attributes of personal data processed are defined by the controller; the personal data we process is non-sensitive in nature. Customer data is handled in a transient manner and is not persistently stored beyond operational requirements such as caching, logging, or audit.
Data subjects can exercise the rights below by writing to mohit@fireai.in. Our Privacy Policy at fireai.in/privacy documents each of these rights.
FireAI defines and documents a process to inform users via a Privacy Notice when collecting and processing their personal data, and notifies users of changes to the privacy notice (Art. 12, 13, 14). A cookie consent banner aligned to GDPR requirements lets users accept or decline the cookie policy, and consent records — including the ability to withdraw — are maintained (Art. 7).
We maintain Records of Processing Activities (ROPA) and a Data Asset inventory capturing the type, source, and category of personal data, along with retention schedules (Art. 30). Personal data attributes are minimized to what is required for the controller's stated purpose, and access is granted and revoked through a documented process (Art. 5, 17, 18, 21). Anonymization and de-identification are applied wherever possible.
Retention timelines are defined contractually with the customer and aligned with applicable law (Art. 5). Personal data from the application is deleted as per the defined timelines and when the client requests deletion; otherwise the data is retained throughout the duration of the contracted service. FireAI does not generate insights from personal data of data subjects through aligned processing activities — insights generated relate only to application performance and availability.
Security controls audited by Aegisra Assurance LLP against Art. 32 include:
FireAI notifies the relevant customer (data controller) of a personal data breach within 48 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects (Art. 33). Where a breach is likely to result in a high risk to data subjects, communication to affected individuals follows without undue delay (Art. 34).
Privacy is built into how the product is engineered. Proposed changes affecting how personal data is processed require management approval before development begins (Art. 35). Development, test, and production environments are segregated; access to production is restricted to authorized personnel; and no production data is used in test environments. Privacy assessment findings are mitigated in a timely manner.
Periodic Data Protection Impact Assessments are conducted, and identified medium and high risks are treated in a timely manner (Art. 35). Where a DPIA indicates that processing would result in a high risk in the absence of measures to mitigate the risk, the supervisory authority is consulted prior to processing (Art. 36).
FireAI has appointed a Data Protection Officer who operates independently and reports directly to the highest management level (Art. 37–38). The DPO has the necessary expertise, professional competence, resources, and training, and is accessible to data subjects and supervisory authorities. Reach the DPO at mohit@fireai.in.
Data Processing Agreements are executed with all third parties that may access personal data processed by the application (Art. 28). Integrations with third-party services — including analytics engines — expose only the minimum necessary personal data attributes, and processor contracts require compliance with data protection regulations.
Personal data transferred outside the EU is protected through Standard Contractual Clauses or binding corporate rules (Art. 44, 46). Transfers to jurisdictions outside the applicable jurisdiction are made only where the level of protection is adequate (Art. 45). FireAI adheres to approved codes of conduct and certifications as a mechanism to demonstrate compliance with GDPR for international data transfers (Art. 40, 42).
Two controls were marked Not Applicable in the audit. FireAI does not collect personal data of children below the legal age, so the parental consent control (Art. 8) does not currently apply. FireAI does not have clients in the EU currently, so an EU representative (Art. 27) has not been appointed.
For any data subject request, DPA, or compliance inquiry — write to our DPO.
Compliance is the outcome — these are the day-to-day controls that get us there.
Granular permissions down to datasource, table, and column — scoped per user, team, or role.
Data Guard enforces row-level policies with scoped data roles and fact-table filters at query time.
AES-256 for stored data, TLS 1.3 for every connection, managed key rotation, and encrypted backups.
Google and Microsoft SSO, password policy enforcement, OTP for sensitive actions.
Tamper-evident audit trail for user, admin, and system actions, retained for forensic review.
Primary data hosted in India with tenant-isolated storage; EU residency available on request.
Rate limiting, SQL injection blocking, strict CORS, and content security headers across all endpoints.
Centralized logs, anomaly detection, and 24/7 alerting on security-relevant events.
Each customer's data is logically isolated; production access requires authenticated, audited paths.
