Enterprise Trust & Procurement
Last reviewed: November 5, 2026
About this page
This page answers the three questions procurement and security teams ask us most, and describes how we handle AI data governance and subprocessors. Specifics for your engagement are set in the agreement, not on this website. Write to consulting@optywise.com for vendor documents or to start a security review.
1. Which legal entity am I contracting with?
Optywise operates through Optywise USA LLC (Wyoming) and Optywise Business Solutions LLP (Pune). The proposal, MSA and SOW name the contracting entity, who invoices, which tax form applies (W-9 from the US LLC, W-8BEN-E from the Indian LLP), and where payments go. Vendor documents available on request.
To request them, email consulting@optywise.com.
2. Where can my data be accessed and processed?
Our standard Forward Deployment model builds and runs systems in the customer's cloud or on-prem environment. Deployment architecture, storage and processing locations and personnel access (including whether authorized engineers in India access data) are set per engagement and documented before implementation, with a customer-specific data residency and access review in discovery, and written into the agreement, security schedule and, where needed, a Data Processing Agreement. Approved external services and subprocessors are disclosed as applicable.
3. What security, confidentiality and IP protections apply?
Our Security page describes the controls built into our delivery, including least-privilege access and audit logging. Our practices are described as aligned with, not certified to, frameworks such as SOC 2, GDPR, ISO 27001, HIPAA and the DPDP Act 2023. Confidentiality terms (such as a mutual NDA), multi-factor authentication requirements, BAAs where applicable and breach-notification commitments are defined per engagement in the security schedule and the agreement.
Ownership and licensing rights for project deliverables, customer data, pre-existing intellectual property, reusable tools and third-party components are defined in the applicable MSA and SOW.
To request a security questionnaire, email consulting@optywise.com.
4. AI Data Governance and Subprocessors
AI model providers, infrastructure services and other subprocessors may be used depending on the solution architecture. Relevant providers, data flows, processing locations and retention arrangements are assessed and disclosed as part of the engagement. Customer data handling and permitted AI processing are governed by the applicable contractual and security requirements.
Each of the following is set per engagement:
- Model providers. Whether customer prompts or data go to external model providers is set per engagement.
- Training. Whether customer data is used for model training, and under which provider settings and contract terms, is set per engagement.
- Logs and observability. Whether prompts, responses, traces, embeddings and session recordings are retained, and for how long, is set per engagement.
- Access. Which Optywise personnel and approved third parties can access the information is set per engagement.
- Deletion. How customer data, logs and derived information are deleted at the end of an engagement is set per engagement.