Trust & security
Everything on this page describes how our software is actually built and operated today. We hold no security certifications, and we don’t claim any — what follows is the engineering, which you are welcome to probe in detail.
Engineering posture
Each tenant's data is isolated at the database level rather than by application code. A query that forgets a filter returns nothing, instead of returning someone else's records — the common way multi-tenant systems leak.
Every action — human or AI — is recorded: who did it, to which record, on whose authority. Auditors and regulators get a real answer rather than a reconstruction.
Seven checks run before a request touches data in Mafield. If a licence, permission or tenant check is missing or ambiguous, the answer is no by default.
Hundreds of automated tests across backend and frontend, including the tenant-isolation rules themselves. Mafield v1.0 shipped with zero known critical security findings.
Models get an identity, a permission set and an audit trail like any other user. If we can't log what it did and bound what it can reach, we don't ship it.
AI runs against a hosted provider or an open model on your own infrastructure. If your data cannot leave your estate, that is a configuration choice rather than a rebuild.
Support commitments
These apply to managed and AMC engagements. For fixed-scope projects, the 90-day defect warranty applies instead.
| Priority | Definition | First response | Thereafter |
|---|---|---|---|
| P1 — Critical | Production down or unusable, with no workaround. | 2 business hours | Continuous work until mitigated, with a status update every 4 hours. |
| P2 — High | A major function is impaired, but a workaround exists. | 1 business day | Fix or mitigation targeted within 5 business days. |
| P3 — Normal | A minor defect, degraded behaviour, or a question. | 2 business days | Scheduled into the next maintenance cycle. |
| P4 — Low | A cosmetic issue or an enhancement request. | 5 business days | Triaged into the backlog and prioritised with you. |
These are response targets. Resolution time depends on the defect — we commit to the response and to continuous communication, not to a fixed clock on every fix. Support hours are Monday to Friday, 09:30–18:30 IST, excluding Indian public holidays. Extended and weekend cover is available, priced separately.
Availability
99.5%
Monthly uptime target for deployments we host and operate, excluding scheduled maintenance — roughly 3.6 hours a month. Maintenance is announced five business days ahead and performed in a weekend window. For client-hosted deployments, availability is yours: we support the application, not your infrastructure.
Reporting a problem
If you believe you have found a security vulnerability in anything we run, please tell us before telling anyone else. Email contact@dhirix.com with enough detail to reproduce it. We will acknowledge within one working day, keep you updated while we fix it, and credit you if you would like us to.
Please don’t run automated scans against production, access data that isn’t yours, or degrade service for anyone else while testing.
Diligence
Security questionnaires, architecture reviews and calls with your technical people are all normal parts of starting work with us. If something on this page needs more detail than a page can give, ask — we would rather answer properly than publish a claim we can’t stand behind.
We'd rather have the security conversation at the start than discover a blocker three months in.