Record 01
Controls follow the selected deployment.
The exact security boundary depends on the approved data flow, deployment environment and allocation of operational responsibility.
Identifiers change at the institution boundary
Data minimisation
For workflows that use cross-institution matching or hosted scoring, direct identity fields are tokenised inside the institution before any approved transfer. The field map and transformation method form part of the deployment design.Deployment is selected with the institution
Documented allocation
Hosted API, customer-controlled VPC and in-institution container options are evaluated against data-residency, network and operational requirements. The selected path and responsibilities are recorded for the engagement.Member records are not pooled
Source records remain separate
Cross-member analysis uses tokenised overlap checks and model updates rather than pooling source customer records in a shared warehouse. Exact data flows depend on the selected deployment and approved use case.Operational scores remain reviewable
Decision evidence
A score used in decisioning is accompanied by its model and policy version, reason codes, recommended action and supporting evidence for later review.
Record 02
The public website keeps a narrow interactive surface.
The site collects less information than a production deployment and avoids unnecessary third-party code.
No customer data in public forms
The public website is not an intake route for applicant records, identity documents, account files or confidential case material.Restricted contact collection
The form accepts business contact fields only. It uses a honeypot, timing check, same-origin check and short-lived rate limit before external delivery.No payload logging
The contact handler does not write submitted fields to application logs or an application database. Delivery still places a copy in the configured mailbox and optional CRM.Minimal third-party code
The public site does not include advertising pixels, session recording, live chat or embedded third-party forms.
Record 03
Architecture context is not a certification.
Customer diligence must test the actual deployment, providers, data categories and contractual allocation.
No certification claim
Praman Labs does not claim an ISO, SOC or other security certification on this page. Any assurance material shared during diligence should be evaluated for its scope, date and issuing party.Institution-specific diligence
Security and privacy review is tied to the selected deployment, data categories, system interfaces and responsible parties. This overview is not a completed customer assessment.Providers and data locations
Applicable infrastructure providers, subprocessors and data locations depend on the selected deployment and are documented during diligence and contracting.Incident terms
Security contacts, notification duties and response expectations are defined in the applicable agreement. This public page does not create a response-time or notification SLA.
Record 04
Report only what is needed to confirm the issue.
Send a concise report before testing beyond what is lawful and necessary to reproduce your own finding.
Include
Provide the affected URL, observed behaviour, reproduction steps and potential impact. Reports are reviewed for reproducibility, impact and safe remediation.Do not include
Do not attach identity records, credentials or customer files. Do not access, change or retain data you do not own.Testing limit
Do not interrupt the service or use high-volume automated testing. Praman Labs does not offer a public bug bounty or authorise testing beyond what is lawful and necessary to confirm your own report.Response boundary
If more detail is needed, Praman Labs will reply to the sender. This public page does not promise a particular response time.