AIRIS is designed around responsible handling of business information and professional engagement practices. The following overview describes how we approach security and information governance during client work.
This page describes our working practices. It does not represent a certification, attestation, or third-party audit.
Confidentiality
Client information shared during AIRIS engagements is treated as confidential and used solely to support the work agreed with the client.
Controlled Access
Access to engagement information is limited to consultants directly involved in the work. Access is reviewed when engagements conclude.
Data Minimisation
We request only the information genuinely required to complete the assessment, and prefer summarised or anonymised inputs where possible.
Secure Infrastructure Practices
Engagement materials are handled on reputable, well-supported platforms with industry-standard transport encryption and account safeguards.
Third-Party Vendor Management
Where third-party services are used to support delivery, we evaluate their suitability and limit the data shared with them.
Incident Response Principles
If a security concern arises that affects client information, we will investigate, contain, and notify affected clients in a timely manner.
Governance & Accountability
Information handling practices are owned by SarvaSoft leadership and reviewed periodically as engagements and tooling evolve.