Security and data protection at CXPLab
Our platform and practices are built around a straightforward principle: your data, and your customers’ data, deserves enterprise-grade protection at every layer.
Governance
Organisational security and accountability
Security is a leadership-level commitment at CXPLab. We maintain a formal information security management programme encompassing policies for data classification, acceptable use, access control, incident response, and business continuity. These policies are reviewed at least annually and updated in response to changes in our operating environment or risk landscape.
Clearly defined ownership ensures accountability at every level. Our security responsibilities extend across engineering, operations, and product teams, with executive oversight of our risk posture. All personnel complete mandatory security awareness training upon joining and on an ongoing basis thereafter. Staff with elevated access to production systems or sensitive data are subject to additional background screening and role-based access restrictions.
Infrastructure
Secure infrastructure by design
CXPLab operates on enterprise-grade cloud infrastructure with built-in redundancy, geographic failover, and physical security controls managed by our cloud provider partners. Our architecture follows the principle of least privilege: each system component, service account, and user is granted only the access required to fulfil its specific function.
All data in transit is protected using TLS 1.2 or higher. Data at rest is encrypted using AES-256. We maintain a vulnerability management programme that includes regular automated scanning, periodic penetration testing by independent third parties, and a formal patch management process to address identified risks within defined remediation windows.
Our environments are logically separated, with production systems isolated from development and test infrastructure. Network segmentation, firewall controls, and intrusion detection mechanisms are maintained across all tiers of the platform.
Data handling
How we handle your data
We apply data classification tiers to all information processed by our platform and enforce controls appropriate to each tier. Access to customer data is limited to authorised personnel on a strict need-to-know basis. All such access is logged and subject to periodic review. We do not sell personal data, and we do not disclose it to third parties for marketing or advertising purposes.
Our data retention schedules are defined per data category and aligned to applicable legal and regulatory requirements. Data is retained only for as long as necessary to deliver contracted services or meet obligatory legal holds. Customers may request deletion of their data, and our processes support those requests in accordance with our terms of service
For full details on how CXPLab collects, processes, and retains personal information, please refer to our Privacy Policy.
Payment security
Cardholder data protection
For customers and implementations that involve payment card processing, CXPLab maintains controls consistent with the requirements of the Payment Card Industry Data Security Standard (PCI DSS). Cardholder data is never stored in plain text. Payment workflows within our platform are scoped and network-segmented to minimise the exposure of card data to systems that do not require it.
We work exclusively with accredited payment service providers and processing partners, ensuring that end-to-end transaction flows meet the required security baseline. Our teams are trained to recognise and uphold cardholder data handling requirements relevant to their roles.
Privacy & compliance
Regulatory alignment
CXPLab designs its data handling, security controls, and operational processes to align with applicable regulatory frameworks. Our programme currently supports the following:
SOC 2 (Security, Availability, Confidentiality) — Our security controls, access management practices, and operational procedures are structured to align with the Trust Services Criteria underpinning SOC 2. This provides our enterprise customers with confidence in the integrity and availability of our platform.
Digital Personal Data Protection Act (DPDP) — We align our data processing practices with India’s DPDP framework, including requirements around lawful purpose, data minimisation, individual rights, and the obligations of data fiduciaries.
PCI DSS — As noted above, our payment-related controls are maintained in alignment with PCI DSS requirements for the protection of cardholder data.
Where payment card transactions are processed through PCI DSS-compliant environments, Sparrow implements security controls designed to protect cardholder data in accordance with applicable PCI DSS requirements.
Sparrow does not store sensitive authentication data, mobile number masking, including full magnetic stripe data, CVV/CVC codes, or PIN data after authorization. Access to cardholder data is restricted to authorized personnel with a legitimate business need and is protected through appropriate administrative, technical, and physical safeguards.
GDPR (in progress) — We are actively working to extend our privacy programme to address the requirements of the General Data Protection Regulation for customers and data subjects in the European Economic Area. We will communicate further on our progress in due course.
Incident response
Response, recovery, and disclosure
CXPLab maintains a documented incident response plan governing the detection, triage, containment, eradication, and recovery phases of any security event. Our incident response team is on call and operates against defined response time objectives for different severity levels.
In the event of a security incident that affects, or is reasonably likely to affect, customer data, we are committed to notifying affected parties in a timely and transparent manner, consistent with our contractual obligations and applicable legal requirements. Post-incident reviews are conducted to identify root causes and drive continuous improvement
If you have identified a potential security vulnerability in any CXPLab product or service, please contact us responsibly at [email protected] We take all disclosures seriously and will respond promptly.
Resilience
Business continuity and availability
Our platform is designed for high availability. We operate across redundant infrastructure zones with automated failover and recovery mechanisms. Our business continuity and disaster recovery plans are tested regularly to validate that recovery time and recovery point objectives can be met under a range of failure scenarios.
Platform uptime, incident history, and scheduled maintenance are communicated to customers through our status channels. Enterprise customers may request additional detail on our availability commitments and SLA terms as part of contract discussions.