Compliance & Certifications

Mimasa AI Regulatory Compliance Framework

Last Updated: January 1, 2025

Version: 1.0

Mimasa AI is committed to maintaining the highest standards of regulatory compliance, data protection, and security certification. Our comprehensive compliance framework ensures that our platform meets and exceeds industry requirements across multiple jurisdictions and regulatory domains.

1. Security Certifications

SOC 2 Type II Certification

Status: Certified

Audit Firm: Independent third-party certified auditors

Scope: Security, Availability, Processing Integrity, Confidentiality, Privacy

Last Audit: December 2024

Next Audit: December 2025

Comprehensive security controls assessment
Data protection and privacy controls verification
System availability and disaster recovery testing
Processing integrity and confidentiality validation
Continuous monitoring and improvement processes

ISO 27001:2013 Information Security Management

Status: Certified

Certificate Number: ISO27001-MA-2024-001

Certification Body: Accredited international certification body

Valid Until: December 2027

Annual Surveillance: December 2025

Information Security Management System (ISMS) implementation
Risk assessment and treatment processes
Security controls across 14 domains
Continuous improvement and monitoring
Incident response and business continuity planning

ISO 27017 Cloud Security

Status: Certified

Certificate Number: ISO27017-MA-2024-002

Valid Until: December 2027

Cloud-specific security controls
Shared responsibility model implementation
Cloud service customer guidance
Virtual network and data isolation

2. Data Protection Compliance

GDPR (General Data Protection Regulation)

Status: Fully Compliant

DPO Contact: dpo@xaigi.tech

Lead Supervisory Authority: Available upon request

Last DPIA: November 2024

Lawful basis for processing established for all data activities
Data subject rights implementation (access, rectification, erasure, portability)
Privacy by design and default principles
Data Protection Impact Assessments (DPIAs) for high-risk processing
Breach notification procedures (72-hour reporting)
International transfer safeguards (Standard Contractual Clauses)
Record of processing activities maintenance
Data minimization and purpose limitation compliance

CCPA/CPRA (California Consumer Privacy Act)

Status: Fully Compliant

Consumer Rights Contact: privacy@xaigi.tech

Consumer right to know personal information collected
Right to delete personal information
Right to opt-out of sale of personal information
Right to non-discrimination for exercising privacy rights
Verifiable consumer request procedures

DPDP Act (Digital Personal Data Protection Act, India)

Status: Fully Compliant

Data Principal Rights: privacy@xaigi.tech

Data principal rights implementation
Notice and consent mechanisms
Data minimization and purpose limitation
Cross-border transfer compliance
Data breach notification procedures

3. Industry-Specific Compliance

Financial Services

PCI DSS: Payment Card Industry Data Security Standard compliance for payment processing
SOX: Sarbanes-Oxley Act controls for financial reporting
MiFID II: Markets in Financial Instruments Directive compliance
Basel III: Capital adequacy framework support
FFIEC: Federal Financial Institutions Examination Council guidelines

Government & Public Sector

FedRAMP: Federal Risk and Authorization Management Program (In Progress)
FISMA: Federal Information Security Modernization Act compliance
NIST: National Institute of Standards and Technology frameworks
ITAR: International Traffic in Arms Regulations support
CUI: Controlled Unclassified Information handling

Education

FERPA: Family Educational Rights and Privacy Act compliance
COPPA: Children's Online Privacy Protection Act adherence
Student Data Privacy: State-level student privacy law compliance
GDPR Art. 8: Enhanced protection for children's data

4. International Compliance

Multi-Jurisdictional Framework

European Union: GDPR, ePrivacy Directive, NIS2 Directive
United Kingdom: UK GDPR, Data Protection Act 2018
Canada: PIPEDA, CPPA (when enacted)
Australia: Privacy Act 1988, Notifiable Data Breaches scheme
Singapore: Personal Data Protection Act (PDPA)
Brazil: Lei Geral de Proteção de Dados (LGPD)
Japan: Personal Information Protection Act (PIPA)

Cross-Border Data Transfers

Standard Contractual Clauses (SCCs) implementation
Binding Corporate Rules (BCRs) where applicable
Adequacy decision compliance
Transfer impact assessments
Data localization requirements adherence

5. AI & Machine Learning Governance

AI Ethics & Responsible AI

AI Act (EU): Compliance framework for AI systems regulation
Algorithmic Accountability: Bias detection and mitigation procedures
Transparency: AI decision-making explainability
Fairness: Non-discrimination and equal treatment measures
Human Oversight: Human-in-the-loop processes

Model Governance

Model development lifecycle management
Data quality and lineage tracking
Model performance monitoring
Bias testing and validation
Model versioning and auditability

6. Compliance Monitoring & Reporting

Continuous Compliance Program

Risk Assessment: Quarterly compliance risk assessments
Control Testing: Monthly internal control testing
Gap Analysis: Semi-annual compliance gap analysis
Remediation: Immediate action on identified gaps
Training: Regular staff compliance training programs

Audit & Reporting

Annual third-party compliance audits
Regulatory examination support
Compliance reporting dashboards
Incident reporting and breach notifications
Management attestations and certifications

Documentation & Evidence

Comprehensive policy and procedure documentation
Control evidence repositories
Audit trail maintenance
Compliance artifact management
Regulatory correspondence tracking

7. Vendor & Third-Party Management

Comprehensive Vendor Assessment:

Due diligence assessments for all third-party providers
Security and compliance questionnaire requirements
Contractual compliance obligations
Ongoing vendor monitoring and reviews
Vendor risk scoring and categorization

Key Vendor Partnerships:

Cloud infrastructure providers (AWS, Google Cloud, Microsoft Azure)
AI/ML service providers (OpenAI, Anthropic, others)
Security and monitoring services
Data processing and analytics tools
Legal and compliance service providers

8. Incident Response & Business Continuity

Incident Response Framework

Detection: 24/7 security monitoring and alerting
Response: Dedicated incident response team
Containment: Rapid isolation and containment procedures
Recovery: Business continuity and disaster recovery plans
Lessons Learned: Post-incident analysis and improvement

Business Continuity Planning

Multi-region data replication and backup
Failover and recovery procedures
Communication and notification protocols
Regular testing and validation exercises
Supply chain continuity planning

9. Contact Information

Compliance Office:

Compliance Officer: compliance@xaigi.tech

Data Protection Officer: dpo@xaigi.tech

Security Officer: security@xaigi.tech

Privacy Officer: privacy@xaigi.tech

General Compliance: legal@xaigi.tech

Business Address:

Xaigi Technology Pvt Ltd

A-130, Sector 63, Noida, Uttar Pradesh 201301, India

Phone: +91 8951394799

Regulatory Inquiries:

Compliance assessments and audits
Regulatory examination support
Certification and attestation requests
Due diligence questionnaires
Vendor compliance validation