Trust Center

How CNTXT AI handles security, compliance and data residency for Arabic voice processing.

CNTXT recognises that the confidentiality, integrity and availability of information and data created, maintained and hosted by us are vital to the success of the business and privacy of our partners. As a service provider/ product, we understand the importance in providing clear information about our security practices, tools, resources and responsibilities within CNTXT so that our customers can feel confident in choosing us as a trusted provider. This Security Posture highlights high-level details about our steps to identify and mitigate risks, implement best practices, and continuously develop ways to improve.

Compliances

Here are the compliance frameworks that Munsit follows which showcases our adherence to industry-standard security guidelines and practices.

Compliant

SOC 2

SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. The standard is based on the following Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

Compliant

ISO 27001

A globally recognized standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

Compliant

GDPR

The General Data Protection Regulation, a comprehensive data protection law in the EU, governs how organizations must protect personal data and privacy.

Compliant

HIPAA

The Health Insurance Portability and Accountability Act, a U.S. law that mandates standards for protecting sensitive patient health information.

Controls 42 controls

Here are the controls implemented at Munsit to ensure compliance, as a part of our security program.

Data security

Identity Validation: Entity ensures that logical access provisioning to critical systems requires approval from authorized personnel on an individual need or for a predefined role.
Termination of Employment: Entity ensures logical access that is no longer required in the event of termination is made inaccessible in a timely manner.
Encrypting Data At Rest: Entity has set up cryptographic mechanisms to encrypt all production database[s] that store customer data at rest.
Data Backups: Entity backs up relevant user and system data regularly to meet recovery time and recovery point objectives and verifies the integrity of these backups.
Testing for Reliability and Integrity: Entity tests backup information periodically to verify media reliability and information integrity.
Transfer of PII: Entity ensures appropriate procedures are in place to ensure compliance with regulatory requirements related to transfer of personal data outside of the region from which it is collected

Network security

Situational Awareness For Incidents: Entity maintains a record of information security incidents, its investigation, and the response plan that was executed in accordance with the policy and procedure defined to report and manage incidents.
Limit Network Connections: Entity ensures that the production databases access and Secure Shell access to infrastructure entities are protected from public internet access.
External System Connections: Every Production host is protected by a firewall with a deny-by-default rule. Deny by default rule set is a default on the Entity's cloud provider.
Transmission Confidentiality: Entity has set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.
Anomalous Behavior: Entity's infrastructure is configured to review and analyze audit events to detect anomalous or suspicious activity and threats
Centralized Collection of Security Event Logs: Entity's infrastructure is configured to generate audit events for actions of interest related to security for all critical systems.

App security

Conspicuous Link To Privacy Notice: Entity displays the most current information about its services on its website, which is accessible to its customers.

Endpoint security

Malicious Code Protection (Anti-Malware): Where applicable, Entity ensures that endpoints with access to critical servers or data must be protected by malware-protection software.

Corporate security

Code of Business Conduct: Entity has a documented policy to define behavioral standards and acceptable business conduct.
Competency Screening: Entity has procedures to ensure that all security-related positions are staffed by qualified individuals who have the necessary skill set.
Personnel Screening: Entity has established procedures to perform security risk screening of individuals before authorizing access.
Security & Privacy Awareness: Entity provides information security and privacy training to staff that is relevant to their job function.
Performance Review: Entity requires that all employees in client serving, IT, Engineering, and Information Security roles are periodically evaluated regarding their job responsibilities.
Automated Reporting: Entity has provided information to employees, via various Information Security Policies/procedures, on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the entity in the event there are problems.
Incident Reporting Assistance: Entity has provided information to customers on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by the Entity in the event there are problems.
Risk Framing: Entity performs a formal risk assessment exercise annually, as per documented guidelines and procedures, to identify threats that could impair systems' security commitments and requirements.
Risk Assessment: Each risk is assessed and given a risk score in relation to the likelihood of it occurring and the potential impact on the security, availability, and confidentiality of the Company platform. Risks are mapped to mitigating factors that address some or all of the risk.
Fraud: Entity considers the potential for fraud when assessing risks. This is an entry in the risk matrix.
Third-Party Criticality Assessments: Entity performs a formal vendor risk assessment exercise annually to identify vendors that are critical to the systems' security commitments and requirements.
Assigned Cybersecurity & Privacy Responsibilities: Entity's Senior Management assigns the role of Information Security Officer who is delegated to centrally manage, coordinate, develop, implement, and maintain an enterprise-wide cybersecurity and privacy program.
Internal Audit using Sprinto: Entity uses Sprinto, a continuous monitoring system, to track and report the health of the information security program to the Information Security Officer and other stakeholders.
Periodic Review & Update of Cybersecurity & Privacy Program: Entity's Senior Management reviews and approves the state of the Information Security program including policies, standards, and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy, and effectiveness.
Management Review of Org Chart: Entity's Senior Management reviews and approves the Organizational Chart for all employees annually.
Management Review of Risks: Entity's Senior Management reviews and approves the "Risk Assessment Report" annually.
Management Review of Third-Party Risks: Entity's Senior Management reviews and approves the "Vendor Risk Assessment Report" annually.
Subservice organization evaluation: Entity reviews and evaluates all subservice organizations periodically, to ensure commitments to Entity's customers can be met.
Subprocessor Requirements: Entity ensures that appropriate remediation measures are in place when personal data is shared with vendors as a part of its processing activities
Data Protection Impact Assessment (DPIA): Entity conducts Data Protection Impact Assessments periodically in order to assess the regulatory risks associated with the processing of personal data
Testing: Entity has procedures to conduct regular tests and exercises that determine the effectiveness and the readiness to execute the contingency plan.
Customer Obligations: Entity maintains a list of all contractual obligations based on customer contracts.
Retention of Policies: Entity ensures that all policy documents are retained for at least (6) years from creation.
Chief Privacy Officer (CPO): Entity appoints a Privacy Officer to assess and facilitate the entity's compliance with relevant regulatory requirements.
Privacy Act Statements: Entity includes Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
Asset Ownership Assignment: Entity has set up mechanisms to assign and manage asset ownership responsibilities and establish a common understanding of asset protection requirements.
Data Governance: Entity maintains a list of legal, statutory, and regulatory requirements relevant to information security.
Updates During Installations / Removals: Entity periodically updates and reviews the inventory of systems as a part of installations, removals, and system updates.

Resources

Here are the important security policies and documents which are a part of Munsit's compliance program.

PolicyAsset Management PolicyView
PolicyData Classification PolicyView
PolicyPersonal Data Breach Notification ProcedureView
PolicyOperation Security PolicyView
PolicyCompliance PolicyView
PolicyOperations Security ProcedureView
PolicyHR Security ProcedureOn request
PolicyBusiness Continuity PlanView
PolicyRisk Assessment & Management PolicyView
PolicySystem Acquisition and Development Lifecycle PolicyView
PolicyEncryption PolicyView
PolicyMedia Disposal PolicyView
PolicyNetwork Security ProcedureView
PolicyPrivacy By Design PolicyOn request
PolicyBusiness Continuity & Disaster Recovery PolicyView
PolicyHR Security PolicyView
PolicyPHI Data breach Notification ProcedureView
PolicyVendor Management PolicyView
PolicyData Protection PolicyView
PolicyCommunications & Network Security PolicyView
PolicyAccess Control PolicyView
PolicySDLC ProcedureView
PolicyAsset Management ProcedureView
PolicyAccess Control ProcedureView
PolicyPhysical & Environmental Security PolicyView
PolicyEndpoint Security PolicyView
PolicyPhysical and Environmental Security ProcedureView
PolicyCode of Business Conduct PolicyView
PolicyInformation Security PolicyView
PolicyIncident Management PolicyView
PolicyVendor Management ProcedureView
PolicyIncident Management ProcedureView
PolicyCompliance ProcedureView
PolicyAcceptable Usage PolicyView
PolicyOrganization of Information Security PolicyView
PolicyData Retention PolicyView
PolicyData Breach Notification PolicyView
DocumentISMS Information Security Roles & ResponsibilitiesView
DocumentISMS ManualView
DocumentISMS Scope DocumentView
DocumentRecords of processing activities (ROPA) and data flow mapsOn request

Trusted by

Check out Munsit's customers that trust us for our robust security program.

Trusted by 250+ companies and government agencies

Get an API key.

One key, every endpoint on this page. You’ll have a transcript back before this tab finishes loading twice.

no credit card · no sales call · unused credits never expire

Get your API key Read the docs