Security posture you can hand straight to your risk team.
Enterprise buyers do not take security on trust, and they should not have to. This page sets out our control environment, how certifications are held across the group, and what we provide during vendor onboarding.
Certifications are held at group level and inherited by every engagement.
Opsvanta Technologies FZ-LLC is the UAE-incorporated technology consulting arm of Red Ruby Enterprises Pvt. Ltd.. ISO/IEC 27001 and SOC 2 are held and maintained by Red Ruby Enterprises Pvt. Ltd., and OpsVanta engagements are delivered inside that information security management system — the same policies, the same access governance, the same auditable controls.
We state this distinction plainly because your vendor risk team will check it. Certificates, scope statements and audit reports are available under NDA during onboarding.
Group structure
- Parent
- Red Ruby Enterprises Pvt. Ltd.
- Certifications held by
- Red Ruby Enterprises Pvt. Ltd.
- Contracting entity (UAE)
- Opsvanta Technologies FZ-LLC
- Registration
- 0000004097331
- Registry
- Ras Al Khaimah Economic Zone Authority (RAKEZ)
Six domains, applied to every engagement.
Controls are proportionate to the sensitivity of the system — a public marketing site and a payments platform are not governed identically — but the domains below are assessed in all cases.
Information security governance
Policies, risk register, asset inventory and supplier assurance maintained under the group ISMS, with defined owners and review cycles.
- Documented security policy set
- Annual risk assessment
- Supplier and sub-processor register
- Security awareness training
Access control & identity
Least-privilege by default. Access to client environments is named, time-bound, logged and revoked as part of offboarding.
- Named individual accounts
- MFA enforced
- Just-in-time privileged access
- Quarterly access reviews
Secure development lifecycle
Security controls run inside the pipeline. Findings block a merge rather than waiting for a review at the end of a release.
- Threat modelling at design
- SAST, SCA and secrets scanning
- Peer review required to merge
- Dependency and SBOM tracking
Infrastructure & cloud security
Hardened baselines, network segmentation and posture monitoring across cloud estates, with configuration held in version control.
- CIS / NIST aligned baselines
- Encryption in transit and at rest
- Posture monitoring & drift detection
- Immutable, reproducible infrastructure
Monitoring & incident response
Logging, alerting and a defined incident process with severity levels, notification timelines and written post-incident reviews.
- Centralised audit logging
- Defined severity matrix
- Client notification commitments
- Root-cause review after every P1/P2
Resilience & continuity
Backup, recovery and continuity planning proportionate to the criticality of the system, tested rather than assumed.
- Documented RTO/RPO targets
- Tested restore procedures
- Multi-region options
- Business continuity planning
Residency and retention are design decisions.
Where personal data is processed, we agree residency, retention, minimisation and deletion during design — before the first schema is written — and record it in the data processing agreement.
GDPR
Data processing agreements, lawful-basis mapping, data-subject request support and EU data-residency options.
UAE PDPL
Federal Decree-Law No. 45 of 2021 considerations for UAE-resident personal data, including consent and cross-border transfer.
India DPDP Act
Digital Personal Data Protection Act 2023 obligations where group delivery teams process personal data.
Sector rules
Where healthcare, financial or public-sector requirements apply, controls are mapped in the design phase, not retrofitted.
This page describes our operating practices. It is not legal advice — your own counsel should confirm the obligations that apply to your data and jurisdiction.
What we provide during procurement.
Standard documentation, prepared in advance. Most of it we can send within a business day of an NDA being in place.
- Signed NDA and mutual confidentiality terms
- Data processing agreement (DPA) with sub-processor list
- Completed security questionnaire (CAIQ or your own template)
- Group ISO/IEC 27001 and SOC 2 documentation on request
- Professional indemnity and cyber liability insurance evidence
- Background-check confirmation for assigned personnel
- Named security contact and incident notification commitments
- Secure access, offboarding and data-return procedures
Responsible disclosure
If you believe you have found a security vulnerability in a system we operate or in this website, please report it to info@opsvantatech.com with “Security” in the subject line. We acknowledge reports within two business days, keep reporters informed of remediation progress, and will not pursue action against researchers acting in good faith who avoid privacy violations, service disruption and data destruction.
Send us your security questionnaire.
We would rather complete it early than discover a blocker at contract stage. Share your template and we will return it with evidence references attached.
Typical response within one business day · NDA available on request