At Resolute,security is not a final checkpoint.It is built into how we modernize legacy systems, reduce technology debt, and deploy AI in environments where reliability and accountability matter.
Built into architecture and delivery from day one
We remove technology and security debt, not relocate it
AI solutions are deployed with agreed data boundaries, controlled access, and privacy-aligned model selection
Access is controlled, intentional, and auditable
We secure what we build; clients control their environment
No “zero risk” claims; clear processes and accountability instead
Certifications are maintained through regular audits and continuous improvement processes.
ISO 9001:2015
Quality Management
2025
ISO/IEC 27001:2022
Information Security Management
2025
ISO/IEC 20000-1:2018
IT - Service Management
2025
EcoVadis Commitment
2025
Secure SDLC embedded in delivery
Vulnerability management (triage → fix → verify)
Secure coding and peer review practices
Dependency and third-party package review
Separation between development and production environments
Controlled access to source repositories and CI/CD pipelines
Modernization that reduces security and technology debt
Clear data boundaries (RAG, scoped inputs)
AI solutions operate within client-approved environments and access boundaries
No training on client data unless explicitly agreed and contractually authorized
Source-aware, traceable outputs
Controlled environments (tenant isolation where required)
Human-in-the-loop for critical decisions
Monitoring and system observability
Structured incident response process
Clear client communication for material incidents
Change management to prevent regressions
Managed services controls (monitoring, patching, logging, anomaly detection)
Role-based access and least privilege
Encryption in transit and at rest (where applicable)
Data minimization by design
Client data ownership and control
GDPR-aligned data processing
We are responsible for the systems we design and deliver within scope. Clients remain responsible for the controls within their environment.
| Resolute | Client | |
|---|---|---|
| AI systems | Prompting, RAG architecture, integration | Tenant, infrastructure, API keys |
| Data access | Enforcing access logic in systems | IAM policies, data provisioning |
| Application security | Secure development, vulnerability fixes | Infrastructure monitoring, OS patching |
| Outcomes | Delivered working system | Validation, human oversight |
Resolute works closely with Amatas, a cybersecurity company within the Ocean Investments group, to extend our capabilities across security operations, testing, and governance.
Access to dedicated cybersecurity expertise
Security testing and independent validation
Monitoring and incident response capabilities where required
Together, we ensure systems are not only built securely but remain secure over time.
Security overview
ISMS overview
Secure SDLC overview
Standard security questionnaire
If you believe you have identified a security vulnerability related to Resolute systems or services, please report it through our designated security channel.
Reported issues are reviewed, assessed, and addressed through established internal processes.
No. Client data is not used for AI model training unless explicitly agreed in writing and approved by the client. AI solutions operate within defined, client-approved data and access boundaries.
AI solutions can be deployed in client-controlled cloud environments or agreed managed environments, depending on the engagement model. Deployment architecture, hosting, and data access boundaries are defined during solution design.
Yes. Resolute regularly works within client-managed Azure, AWS, and hybrid enterprise environments. Access, deployment, and operational responsibilities are aligned during onboarding and delivery planning.
Additional security and compliance documentation can be shared as part of vendor due diligence and onboarding processes.
Security concerns or suspected vulnerabilities can be reported through our designated security contact channel.
Reported issues are reviewed, triaged, and addressed through defined internal processes.
Access is granted based on least privilege principles and aligned with project responsibilities. Sensitive access is controlled, reviewed, and limited to authorized personnel where applicable.
Yes. Resolute supports enterprise delivery requirements through established engineering, security, and operational practices. This includes secure development processes, controlled access, auditability, and alignment with applicable client requirements.
Security responsibilities are shared between Resolute and the client, depending on the delivery and hosting model. Specific responsibilities are clarified during scoping, architecture, and onboarding activities.