Customer-segregated paths
Engineering repositories and deployment paths segregated by customer as the default design pattern.
Security and compliance
India GCC security posture you can review early
Distributed teams need a security model that survives procurement, audit, and real operating pressure. MedRec brings access, identity, evidence, and subprocessor discussions into the first workshops instead of treating them as contract cleanup.
Core controls
Defaults that stand up to diligence
Mutual trust agreements
Mutual confidentiality established before architecture, data-flow, or environment design sessions.
Role-based access control
MFA and joiner-mover-leaver workflows aligned to your identity provider where appropriate.
Visible subprocessors
Transparent subprocessors and controls mapped to recognised security criteria and standards.
Early diligence
What we clarify before deep architecture
For active evaluations we share policies, sample agreements, incident response material, and audit context under mutual NDA.
One controls framework for US, UK, and India delivery →- Customer-segregated engineering paths and repositories as the default design.
- Mutual confidentiality before architecture, data-flow, or environment design sessions.
- Role-based access, MFA, and joiner-mover-leaver workflows aligned to your identity provider where appropriate.
- Transparent subprocessors and a controls view mapped to recognised security criteria.
Common questions
Security in GCC diligence
When reviews start, what is aligned, and what you can see under NDA.
When do security discussions start?
Early. Access, identity, evidence, and subprocessor discussions belong in the first workshops, not as contract cleanup after selection. Security questions are answered before architects and data-flow diagrams go deep.
Which frameworks are controls aligned to?
Controls are aligned to frameworks your reviewers already use: SOC 2, ISO 27001, GDPR, India DPDP, and HIPAA-aware delivery where relevant. Current certification and audit status is shared in writing under NDA so diligence rests on evidence rather than badges.
How is customer work segregated?
Repositories and deployment paths are segregated by customer as the default design. Role-based access and joiner-mover-leaver workflows reduce shared-environment risk across engagements.
What evidence can we review under NDA?
For active evaluations we share policies, sample agreements, incident response material, and audit context under mutual NDA. Start with a short scoping conversation and we will route you to the right security and delivery leads.
How does this relate to cross-border GCC delivery?
US, UK, and India expectations often overlap. Mapping SOC 2, India DPDP, and UK/EU processor duties into one evidence model keeps audits from multiplying questionnaires. See our insight on building one controls framework for cross-border GCCs.
Ready for your security review
Start with a short scoping conversation. We will route you to the right security and delivery leads and share evidence under NDA when diligence is live.
Mutual NDA before detailEvidence under reviewBook a planning call