Security, data protection and AI governance, built into how we deliver.
AI executes the work on the Agentic SDLC. Your people approve what matters. Your code, data and deliverables stay yours. This page explains how, in plain language, and what we leave to your contract.
- Human-governed
- Your environment
- Full audit trail
NDA available on request. Reply within one business day.
- Human approval at defined gatesRequirements, architecture, release and production
- Your environment, your access rulesWe work only through access you grant
- An audit trail of every decisionRecorded as the work happens
- Your data is not used to train modelsWithout your prior written permission
How does Stack18 keep client data and AI work secure?
Stack18 delivers on the Agentic SDLC, where AI agents execute work but people approve requirements, architecture, releases and production changes at governance gates. Solutions and Enterprise work runs in environments you own or control, and every decision is recorded in an audit trail. We do not use your source code or business data to train AI models without your prior written permission.
Five gates between an idea and production.
Gates are configurable per project, team and risk level, and every decision is recorded to the audit trail. AI does the repetitive work; your people decide what moves forward.
Intent gate
Scope, goals and constraints are confirmed before anything is built.
Requirements gate
Acceptance criteria are approved by you before design starts.
Architecture gate
Design and data decisions are signed off before code is generated.
Release gate
Quality and security evidence is reviewed before a release candidate moves on.
Production gate
Promotion to production is approved by the right owner.
AI executes. Your people govern.
Human approval is required for production releases, architecture changes and data access.
The repetitive, high-volume work
- Define and design
- Draft requirements, user stories, architecture and data models for review.
- Build and test
- Generate code, tests and documentation, then run functional, regression and security checks.
- Deploy and operate
- Build pipelines, stage releases, monitor health and suggest fixes.
The decisions that carry risk
- Approve
- Requirements, architecture and design decisions, and promotion to production.
- Control
- Permissions and role-based access, with security policies enforced per workflow.
- Review
- Quality and security evidence, with an audit trail of every approval.
Your code, your data, your environment.
Ownership, access and AI handling are written into our Terms of Service and Privacy Policy, and into your agreement.
You own your work
Subject to payment of the fees due, you own the source code, configurations, designs and documentation created for you, and you retain ownership of your data.
- Deliverables created for you
- Your data and content
- Set out in our Terms of Service
Your environment
Solutions and Enterprise deliverables are deployed on servers, cloud accounts or environments that you own or control. The Agentic SDLC platform can run on your infrastructure.
- Access only as you grant it
- Only for the work engaged
- Only for as long as needed
AI and model training
We do not use your source code or business data to train AI models without your prior written permission.
- Approved AI providers agreed in advance
- Data handling agreed in advance
- Your data stays in your environment
Data protection and residency
Data handling is aligned with India’s DPDP Act and your own policies, with data residency in Indian regions where needed.
- Role-based access to data
- Policies enforced per workflow
- Retention set in your agreement
Access and confidentiality
On Enterprise pods, every member works under SSO, least-privilege access and joiner-mover-leaver controls, with NDAs, IP assignment and background-verified team members.
- SSO and least-privilege access
- NDAs and IP assignment
- Confidentiality continues after the engagement
Our delivery controls and offboarding
Our delivery workflows use access controls, least-privilege access, encryption in transit and audit logging. At the end of an engagement we return or delete engagement materials and revoke access.
- Audit logging of delivery workflows
- Encryption in transit
- Access revoked at the end
If you run AI agents of your own, run them under control.
The same governance ideas apply to the AI you put to work in sales, support, finance and operations. AI Enterprise OS includes the controls below, so agents reach production with oversight from the first day.
Permissions and approvals
Define what each AI agent can read, write and do alone, and what needs a person to approve.
- Per-agent permissions
- Human approval for what matters
Audit trail and observability
Every prompt, tool call and decision is logged and searchable.
- Searchable history
- Review workflows
Guardrails and PII redaction
Unsafe outputs are blocked, and Aadhaar, PAN, phone and account numbers are masked, in line with DPDP expectations.
- Budgets and guardrails on requests
- PII masked before it reaches a model
Private by design
AI Enterprise OS gives your company a private AI workspace on your own data. Models are accessed through enterprise APIs or hosted in your cloud, and your data is not used for training.
- Respects access rights in the knowledge base
- Runs in your environment
No system is completely secure, and we do not pretend otherwise.
This is how we deliver, not a certificate
This page describes our delivery approach. It does not list certifications. If your procurement team needs a specific one, ask us on the first call and we will tell you plainly what is in place.
Your contract is the source of truth
Our Terms of Service, Privacy Policy and your signed agreement govern what we commit to. Hosting regions, approved AI providers and retention are agreed with you in advance.
AI output can contain errors
That is why people review critical output and approve at gates. You stay responsible for timely approvals, and nothing reaches production without one.
Security and AI governance questions.
Do you use our data or code to train AI models?
No, not without your prior written permission. Where the Agentic SDLC uses third-party AI services during an engagement, we agree the approved providers and data handling with you in advance.
Where does our data live?
In environments you own or control. Solutions and Enterprise deliverables are deployed on your servers or cloud accounts, and we can support data residency in Indian regions where needed.
Can AI push changes to production without approval?
No. Promotion to production is approved by the right owner at the production gate, and human approval is required for production releases, architecture changes and data access.
Who owns the code you build for us?
Subject to payment of the fees due, you own the source code, configurations, designs, documentation and other deliverables created specifically for you. Stack18 retains ownership of its own platform, tools, frameworks and templates.
Will you sign an NDA?
Yes. NDAs are available on request, and our confidentiality duties continue after the engagement ends. Enterprise pods also include IP assignment and background-verified team members.
Can the Agentic SDLC run on our own infrastructure?
Yes. The platform can be deployed on your own infrastructure and connects to your Git, cloud, CI/CD, identity and observability tools.
Do you hold ISO 27001, SOC 2 or similar certifications?
This page does not list certifications. If your procurement requires a specific one, tell us on the first call and we will answer plainly, including what we can offer in its place, such as security reviews scoped with your team.
How do I raise a security concern or a privacy request?
Write to privacy@stack18.com or use our contact form. Our Privacy Policy sets out your rights under India’s Digital Personal Data Protection Act, 2023 and, where they apply, other data protection laws.
Questions from your security team?
Share your security, privacy or compliance questions. A senior specialist will reply within one business day with next steps.
- Free 30-minute consultation
- Indicative estimate after the call
- NDA available on request