Legal
Security
Karvark Tech Labs LLP · Last updated: 11 September 2026
How we build
Every system we ship is specified before it is built, tested against named invariants, and reviewed before release. Concretely:
- Documents before code. Architecture, data model and test strategy are written and version-controlled before implementation begins
- Deterministic control. AI models narrate; code and database constraints decide. Context is assembled by code, never composed freely by a model
- Human override. Systems that act on a client's behalf ship with a live takeover path and a full audit trail
- Tested continuously. Changes are gated on automated tests in continuous integration
How we run infrastructure
- Least-privilege access; secrets held in a secrets manager, never in source control or documents
- TLS in transit; encryption at rest on managed data stores
- Infrastructure defined as code and version-controlled
- Audit logging on privileged and mutating operations
- Regular patching of operating systems and pinned, deliberately upgraded application images
Threat model
We maintain a written threat model for AI systems, covering prompt injection, untrusted input, and data exfiltration. Where a system combines untrusted input, private data and an outbound channel, we treat that combination as the primary risk and cut it architecturally. Adversarial test cases are a release gate, not an afterthought.
Data handling
Client data stays in the client's environment wherever the architecture allows. Where we process data on a client's behalf, we do so as a processor under a written agreement, on documented instructions.
Reporting a vulnerability
If you believe you have found a security issue in anything we operate, email founder@karvark.com with the details. We will acknowledge within three business days. Please give us reasonable time to remediate before public disclosure. We will not pursue legal action against good-faith research that avoids privacy violations, service degradation and data destruction.