Enterprise security and AI compliance by design.
How Clepto builds, deploys, and hardens production systems across cloud infrastructure, custom software, and autonomous AI agents. We use the OWASP Top 10 and the OWASP Top 10 for LLM Applications as references when we build.
1. The Clepto Security Tenets
In an era of rapid AI adoption, security cannot be an afterthought bolted on before release. Every system we build follows these principles:
By preference, code, databases and credentials are set up in the client's own accounts (for example Cloudflare or Supabase). After handover we don't keep access unless the client asks us to.
We don't use client data to train AI models unless the client asks us to in writing. Where an AI provider offers settings that keep business data out of training or limit how long it is kept, we use them.
AI agents get only the access they need for their task, and their actions are logged.
Any action carrying irreversible business impact (payments, contract execution, bulk record deletion) requires a person to approve it before it happens.
2. Standards & Regulatory Mapping
The frameworks and laws we work with, and how we apply them:
| Framework / Law | Scope & Jurisdiction | How we apply it |
|---|---|---|
| OWASP Top 10:2025 | Web & API Applications | Parameterized queries, schema validation with Zod, strict CSP, SSRF URL allowlists |
| OWASP LLM & Agentic 2026 | AI Workflows & Agents | Prompt injection sanitization, tool description integrity checks, circuit breaker kill-switches |
| India DPDP Act 2023 & Rules 2025 | India | Itemized consent records, right to nominate, local Grievance Officer, 72h CERT-In / Board notice |
| EU & UK GDPR | European Union and UK | Article 28 DPA, Standard Contractual Clauses, right to erasure across caches and vector indices |
| UAE PDPL (Law No. 45/2021) | United Arab Emirates | UAE data handling rules and protections for cross-border transfers |
| EU AI Act (Article 50 & 4) | AI Transparency & Literacy | Clear AI disclosure on every chat and voice agent |
3. Reporting a security issue
Clepto welcomes reports from security researchers. Our security contact is published in an RFC 9116 security.txt file:
- Security Point of Contact:
security@clepto.in - RFC 9116 Endpoint: /.well-known/security.txt
- What happens next: We acknowledge reports, investigate, and keep the reporter updated until the issue is resolved.
- Safe Harbor: Researchers who conduct testing in good faith within scope will not face legal action.