Security at Geckolyst
Protecting customer information and supporting the availability, integrity and confidentiality of the Geckolyst services are important parts of how we operate. This page provides a high-level overview of our information-security practices.
Geckolyst Solutions Private Limited applies information-security processes and technical and organisational safeguards intended to help protect the systems and information used to provide its customer-experience, feedback-management, analytics and related services. The specific controls applicable to a customer depend on the service, deployment model, configuration and contractual arrangements.
This page is a general overview, not a security certification, audit report, guarantee of uninterrupted service, or replacement for a signed customer agreement, Data Processing Agreement (DPA), or service-level agreement (SLA).
1. Governance
Information Security Governance
Geckolyst maintains information-security policies and procedures intended to support the secure operation of its services. Responsibilities for information security are assigned within the organisation, and relevant processes may include risk assessment, change management, access reviews, incident handling and employee awareness.
Security practices and controls are reviewed and updated as appropriate to address changes in systems, risks, business operations and applicable requirements.
2. Data Protection
Data Handling and Encryption
Geckolyst uses technical and organisational safeguards designed to protect information processed through its services. Depending on the service and configuration, these safeguards may include encryption in transit and encryption at rest, controlled access to systems and data, logging, and secure handling of credentials and secrets.
Customer information is processed to provide and support the contracted services, subject to the applicable contract, DPA and Privacy Policy.
3. Identity and Access
Access Management
Access to systems and information is intended to be limited to authorised personnel and approved purposes. Access-management practices may include role-based permissions, least-privilege access, authentication controls, multi-factor authentication for privileged access, and periodic access reviews.
Customers are responsible for managing their own users, credentials, permissions and account settings within the services, including maintaining the confidentiality of authentication credentials and promptly notifying Geckolyst of any suspected unauthorised access to their accounts.
4. Secure Development
Application and Change Security
Changes to applications, infrastructure and deployment processes are managed through defined processes. Security considerations may be incorporated into development, testing, release and change review activities. Development and testing access is controlled, and environments are separated where appropriate to reduce risk to production services.
5. Monitoring
Network and Operational Security
Geckolyst uses operational controls intended to identify and respond to threats affecting service infrastructure. Depending on the environment, these may include network protections, endpoint security, logging, alerting, monitoring, controlled administrative access and review of relevant security events.
Access to production environments is restricted to authorised personnel and managed through approved access methods.
6. Testing
Vulnerability Management
Geckolyst conducts security reviews and vulnerability-management activities appropriate to the nature, complexity and risk profile of its systems and services. These activities may include vulnerability assessments, security testing, penetration testing by qualified personnel or external specialists, identification and classification of vulnerabilities, remediation tracking and verification of corrective measures. Security testing is conducted under defined authorisation, scope and procedures.
Customers and third parties must not conduct penetration testing, vulnerability scanning or other security assessments against Geckolyst's systems, applications or infrastructure without obtaining prior written authorisation from Geckolyst. Any authorised testing must be conducted strictly within the approved scope and conditions.
7. Resilience
Backup, Recovery and Continuity
Backup and recovery processes are used where applicable to support service resilience and restoration. Backup scope, frequency, retention, recovery time objectives and recovery point objectives may differ by service and deployment configuration. Specific commitments apply only where documented in the relevant customer agreement or service documentation.
8. People and Premises
Personnel and Physical Security
Geckolyst uses personnel and workplace controls intended to protect business systems and information. Depending on role and applicable requirements, these may include confidentiality obligations, security awareness, access restrictions, visitor controls and physical safeguards at facilities used for business operations.
9. Cloud Infrastructure
Third-Party Infrastructure and Providers
Geckolyst uses third-party infrastructure and service providers, including cloud services, where required to deliver its products. Provider-specific security responsibilities are shared according to the services used and the applicable agreements. Geckolyst remains responsible for its own obligations under customer contracts and applicable law.
Information regarding relevant subprocessors and third-party service providers, including their roles in processing customer information, may be made available through the applicable DPA, customer documentation or upon an appropriate customer request, subject to applicable confidentiality and contractual restrictions.
10. Incident Response
Security Incident Management
Geckolyst maintains processes for reporting, assessing and responding to suspected security incidents. Where an incident affects Customer Data and notification is required by applicable law or the relevant customer agreement, Geckolyst will notify the customer in accordance with those requirements.
When initially reporting a suspected security incident, please do not include passwords, authentication tokens, sensitive customer information or other confidential credentials. Such information should only be shared through an appropriate secure channel if specifically requested and necessary for the investigation.
11. ISO/IEC 27001:2022
Security Certifications & Compliance
Geckolyst Solutions Private Limited is certified to ISO/IEC 27001:2022 for its Information Security Management System (ISMS). The certificate was issued by MQA Certification UK Ltd. and is currently valid, subject to the certification body's requirements and ongoing surveillance.
| Standard | ISO/IEC 27001:2022 |
| Certification body | MQA Certification UK Ltd. |
| Certificate number | 2026-00755-IN-27K |
| Initial registration date | 7 October 2026 |
| Certificate expiry date | 6 October 2027 |
Certified Scope
The Information Security Management System (ISMS) covers the design, development, operation, maintenance, and support of Geckolyst's customer experience management and analytics platform and related software solutions. This includes survey and feedback management, customer and conversational quality assurance, ticket management, customer and employee experience analytics, data processing and analysis, customer support, and related IT services. The scope includes the people, processes, information, applications, infrastructure, and technologies used to provide these services to customers, as per the Statement of Applicability (SoA) dated 1 August 2026, Version 00.
Check certificate validity in MQA's certified-client directory
Customer Assurance
Geckolyst may provide certification details, independent assurance reports, security questionnaires or other relevant security documentation to customers through an appropriate review process, subject to availability and confidentiality restrictions.
The certification applies to the scope stated in the certificate. It should not be interpreted as a guarantee that security incidents cannot occur or that every control applies identically to every product, deployment or customer environment. Other certifications or assessments will be listed only when formally issued and valid.
12. Report a Security Concern
If you believe you have identified a security vulnerability or security incident related to Geckolyst, contact our security team at security@geckolyst.com.
Please include a clear description of the suspected vulnerability or incident, its potential impact and the steps required to reproduce the issue, where safe and appropriate. While investigating or reporting a suspected vulnerability, you must not access, alter, download, retain, disclose or otherwise interfere with information belonging to other users or customers, or undertake any activity that may disrupt, impair or compromise our services. Geckolyst may request additional information reasonably necessary to assess and investigate the report.
For general privacy questions, contact privacy@geckolyst.com. For general support, contact support@geckolyst.com.
Related Information
This page provides a general description of security practices and may be updated as practices evolve. It does not disclose confidential security configurations or guarantee that every control applies to every product or customer environment.