Last Updated: 26 February 2026
Karsaaz EBS builds and operates digital products and technology services with a structured focus on security, privacy, and operational governance. This page provides a centralized overview of how security and compliance are managed across the Karsaaz EBS group and its product ecosystem.
This information is provided to support transparency for customers, partners, and auditors. For legally binding terms and detailed disclosures, please review the following documents:
Karsaaz EBS follows an enterprise aligned approach to security and compliance that is designed to scale across products, regions, and customer requirements.
Our approach is based on the following principles:
Important Note: Security and compliance controls may vary by product, region, customer configuration, and contractual scope. Controls are applied in proportion to the nature of the service and the associated risks.
Karsaaz EBS operates as a global technology group with multiple entities supporting legal governance, engineering delivery, and regional operations. Responsibilities are structured to support auditability, continuity, and regulatory accountability.
Registered office: 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom
ICO registration reference: ZB891350 (registered under Karsaaz EBS Ltd, United Kingdom)
ISO/IEC 27001:2022 – Information Security Management Systems
ISO/IEC 20000-1:2018 – IT Service Management Systems
ISO 9001:2015 – Quality Management Systems
Scope note: ISO certifications apply only to the certified entity and the specific scope stated on each certificate.
Where data is accessed by the Pakistan entity on behalf of the UK entity, transfers are governed by appropriate contractual safeguards, including Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Agreement (IDTA), together with technical and organizational controls.
Unless otherwise specified in a product-specific notice, the UAE entity does not act as Data Controller for personal data collected through this website.
Transparency note: Payment processing may be facilitated by the group’s UAE entity depending on product and customer location. Payment data is processed by payment service providers under their own security and compliance standards.
Karsaaz EBS applies a layered security model across its products and internal systems. Controls may vary by service but typically include the following measures.
Digital products are hosted on established cloud infrastructure providers.
Hosting regions are determined by product architecture, customer configuration, and contractual arrangements. Default hosting regions may include the United Kingdom, European Union, or United Arab Emirates, depending on product configuration and contractual structure.
Karsaaz EBS uses third-party service providers to support infrastructure, analytics, communications, customer support, and operational tooling.
All subprocessors are assessed based on security, privacy, and operational risk. A maintained Subprocessors List is published separately and updated as changes occur.
Specific subprocessor identities may be provided in product-specific documentation or contractual agreements where required.
We aim to collect and process only the data necessary to deliver and improve our services, meet security requirements, and comply with legal obligations.
Key privacy principles include:
For full details on data categories, lawful bases, retention periods, user rights, and international transfers, please refer to the Privacy Policy.
Certain Karsaaz EBS products use artificial intelligence and automation to support user productivity, such as summarization, transcription, language processing, and assistant-based features.
AI features are designed as human-in-the-loop tools intended to assist users rather than act as sole decision-makers. Karsaaz EBS does not deploy AI systems to make automated decisions that produce legal or similarly significant effects on individuals without human involvement.
AI systems are intended to assist users and are not deployed as sole decision-making systems for legally significant outcomes.
AI-generated outputs may be probabilistic and may contain inaccuracies. Users are responsible for reviewing outputs before relying on them for high-stakes or critical decisions.
Client production data is not used to train foundation models without explicit consent or appropriate anonymization.
Product-specific AI limitations and responsibilities are detailed in the AI Use & Liability Disclaimer and relevant product documentation.
When payment functionality is enabled:
Billing and payment records may be retained as required for accounting, tax, and regulatory obligations.
As a global organization operating across the UK, UAE, Pakistan, and other customer locations, cross-border data processing may occur.
Where international transfers take place:
Details regarding transfer mechanisms are described in the Privacy Policy.
We encourage responsible disclosure of security issues.
Please avoid including sensitive personal data unless necessary to describe the issue.
Privacy contact: privacy@karsaaz.com
Privacy related inquiries are handled through the designated Privacy Contact.
This page may be updated to reflect changes in security controls, compliance posture, subprocessors, legal requirements, or product architecture. Material updates will be reflected by revising the “Last updated” date above.
This page is provided for informational purposes to demonstrate transparency and accountability. It does not constitute a legal warranty and does not modify or replace the terms of any Master Service Agreement (MSA), Data Processing Agreement (DPA), or other contractual documents between Karsaaz EBS and its customers.