For procurement and compliance teams
Built to pass vendor due diligence
If your institution is evaluating Asaan Compliance as a vendor, this page lists what we provide for onboarding and how our delivery maps to the SBP outsourcing framework. Request the full pack below.
What we provide on request
Mutual NDA
Signed before any client data or detailed scoping information changes hands.
Information Security Policy
Access control, data handling, retention, and incident response for engagement data.
BCP / DR summary
How delivery continues through disruption, including alternate working arrangements.
Audit rights
Contractual right for your institution to audit our controls relevant to your engagement.
Exit and data return
Defined exit terms: return or certified destruction of your data at engagement end.
SBP outsourcing framework alignment
For regulated institutions, engaging us is an outsourcing arrangement under BPRD Circular 06 of 2019. Our standard terms are written to slot into that assessment.
| Framework expectation | Our answer |
|---|---|
| Written agreement with defined scope and service levels | Every engagement runs on a written scope with SLAs and a named engagement lead. |
| Confidentiality and data protection | NDA-first engagement, documented InfoSec policy, access limited to the engagement team. |
| Location of processing | Onshore only. All processing is performed in Pakistan; on-premise delivery available where data must not move. |
| Right to audit and regulator access | Audit rights for your institution and access for SBP inspectors are accepted in our standard terms. |
| Business continuity | BCP/DR summary provided; filing-season staffing is planned with redundancy. |
| Exit management | Exit terms cover handover, data return, and certified destruction. |
Onshore processing statement
Asaan Compliance processes all client data onshore in Pakistan, using its own personnel. We do not transfer client data outside Pakistan and do not subcontract data handling. Where an institution requires it, work is performed on the institution's own premises and systems. This statement may be reproduced in vendor onboarding documentation.
Request the vendor onboarding pack
Tell us who you are and we will send the pack — NDA template, InfoSec policy, BCP/DR summary, and standard terms — to your work email.