Effective date: 13 October 2026 · Version 1.1 · Classification: Public · Reference: ABT-COC-2026-01
Issued by the Board of Alterbasics Technologies Pvt. Ltd. (Colrows). Applies to all directors, officers, employees and contractors. Status: Approved.
1. Purpose and Scope
This Code of Conduct sets out the business principles and standards of behaviour that guide how we work at Alterbasics Technologies Pvt. Ltd., the company behind the Colrows product. It states what we stand for, how we treat each other and the people we work with, and how we build and run our technology.
This Code applies to all directors, officers, employees, contractors, interns and other individuals acting on behalf of Alterbasics Technologies Pvt. Ltd. We expect each of them to know these principles and to apply them in their daily work. We also expect our suppliers, consultants, service providers and business partners to uphold standards consistent with this Code, in particular where they access our systems, handle information entrusted to us, or represent the company, and we extend the applicable standards to them through our contracts. Our Board has approved this Code and is responsible for it.
Where applicable law, or a contractual commitment the company has accepted, imposes a stricter requirement than this Code, we comply with that requirement to the extent it applies to our activities and services.
2. Our Business Principles
Our conduct rests on a small set of principles that apply across everything we do:
- We act with honesty and integrity, and we keep the commitments we make, including in how we describe our products, their performance and their security.
- We comply with the law and hold ourselves to high ethical standards even where the law is silent.
- We treat our people, customers and partners with fairness and respect.
- We protect the data and trust that customers place in us.
- We build technology that is governed, traceable and answerable to the people who use it.
- We take responsibility for our decisions and raise concerns when something is wrong.
3. Compliance with Laws
We conduct our business in line with the laws and regulations of each country in which we operate. This includes, as applicable, company law, tax law, competition and anti-trust law, employment law, data protection law, export controls and trade sanctions. We hold the registrations, licences and approvals required for our activities and keep them current.
4. Integrity and Anti-Bribery
We do not offer, promise, give, request or accept any bribe, kickback or other improper advantage, whether directly or through a third party, and whether in dealings with public officials or private parties. This standard applies to facilitation payments, which we do not make.
We accept and offer gifts and hospitality only where they are modest, infrequent, openly given, and lawful for both sides. We do not give or accept cash or cash equivalents, including gift cards. Gifts or hospitality during an active tender, procurement or contract negotiation require additional scrutiny, and anything involving a government official requires prior approval and must comply with applicable law. We do not use gifts or hospitality to obtain or retain business improperly. We keep accurate books and records and do not maintain undisclosed or off-book accounts.
We identify and manage conflicts of interest. Where one of our people has a personal financial interest, a close family relationship or an outside business interest that could affect, or appear to affect, a company decision, that interest is disclosed, reviewed, and the person steps back from the decision.
5. Fair Competition and Trade
We compete on the merits of our product and service. We do not enter into agreements with competitors to fix prices, rig bids, allocate markets or customers, or restrict supply. We do not obtain or use competitors' confidential information through improper means, and we do not misrepresent our products, capabilities or performance when competing for business. We respect applicable trade controls, including sanctions and export restrictions, as they apply to our counterparties and to the export or transfer of our software, technical information and AI models.
6. Our People and Human Rights
We respect internationally recognised human rights and support the principles of the Universal Declaration of Human Rights and the International Labour Organization core conventions. Within our own workforce, which is engaged in software development, professional services and corporate functions, we hold to the following:
- Employment is freely chosen. We do not use forced, bonded or involuntary labour.
- No child labour. We do not employ anyone below the legal minimum working age, and in no case below the age of 15, or 14 where local law permits that limit.
- No discrimination. We recruit, pay and promote on the basis of ability and performance, and do not discriminate on grounds such as race, colour, caste, ethnicity, sex, sexual orientation, gender identity or expression, religion, political opinion, national origin, age, disability, marital status, pregnancy, caregiving or family responsibilities, or any other ground protected by applicable law.
- No harassment. We do not tolerate physical, verbal, sexual or psychological harassment, bullying or intimidation, whether in person, through electronic communications and online meetings, or at work-related events and travel. We do not retaliate against anyone who reports harassment or takes part in an investigation.
- Fair pay and working hours. We pay at least the legal minimum wage and legally mandated benefits, and set working hours within the limits of applicable law.
- Freedom of association. We respect the right of our people to associate freely and to bargain collectively within the law, without fear of reprisal.
We are also mindful of the human rights impact of the technology we build. Governed data access is part of this, but it is not the whole of it: a user with legitimate access can still put a system to a harmful use. We therefore seek to prevent the misuse of our products for unlawful surveillance, discriminatory profiling, manipulation or other activities that could infringe fundamental rights. We assess the material risks of intended use cases, provide governance and oversight mechanisms, and reserve the right to restrict or discontinue support for uses that breach applicable law or our ethical standards.
7. Health and Safety
We provide a safe and healthy working environment and comply with applicable occupational health and safety law. As a software company, our primary risks relate to office and remote working conditions, including workstation ergonomics and working hours. We also care about psychological safety and well-being: we set reasonable workloads and do not normalise sustained overwork or an expectation of constant availability. We manage these risks and give our people the information they need to work safely.
8. Environment and Sustainability
We comply with applicable environmental law and seek to reduce the environmental impact of our operations. As a software company, our footprint arises mainly from office and remote-working energy use, the cloud and AI computing resources we consume, the hardware we procure over its lifecycle, electronic waste and business travel. Our product also runs in customer-managed and on-premises environments, where the infrastructure footprint sits with the customer. We seek to improve resource efficiency across our operations and deployments, taking into account the data residency, security and regulatory obligations that apply to each customer, and we manage electronic waste responsibly.
9. Data Protection and Information Security
We protect the confidentiality, integrity and availability of the information entrusted to us. We handle personal data in line with applicable data protection law. Depending on the processing activity and the applicable law, we act as a data processor, a service provider or an independent controller. Where we process customer data on a customer's behalf, we do so under documented instructions, the applicable data processing agreement and relevant legal requirements. We act as a controller for our own business data, such as account administration, billing, website and business-contact information.
We operate an information security management system aligned with ISO/IEC 27001:2022, with controls for access management, encryption of data in transit and at rest, logging and monitoring, vulnerability management and incident response. We report security incidents that affect customer data to the affected customer in line with the timelines set in the relevant agreement.
We enforce customer-defined access and governance policies across the supported data access and execution pathways. These controls include role-based and attribute-based permissions, least-privilege execution, and applicable row-level, column-level and masking policies, and they apply to access by users and by agents. We integrate with customer identity and access-management systems where supported, and we keep audit records of governed access and execution. The controls that apply in a given case depend on the deployment architecture, the supported integrations and the customer's configuration.
We apply the principle of least privilege to our own personnel, restrict access to authorised people, and do not access customer data except as needed to deliver and support the service. We do not disclose or reuse customer information for unrelated business purposes. Retention, backup retention, return and deletion of customer data at the end of an engagement are handled as set out in the relevant agreement.
10. Secure Development and Software Supply Chain
We follow a secure software development lifecycle. Security is considered in design, code is subject to review, and changes are tested before release. We carry out security testing, including dependency scanning, secret management and periodic penetration testing. We manage the open-source and third-party components we use, track them, monitor them for known vulnerabilities, and remediate material vulnerabilities on a severity-based timeline. We can provide a software bill of materials for our product on request. We separate development, testing and production environments and control changes to production. We provide a channel through which security researchers, customers and partners can report vulnerabilities, and we investigate and address valid reports.
11. Responsible Use of Artificial Intelligence
Colrows is an autonomous semantic layer and governed AI agent infrastructure. It compiles business questions into governed queries against the customer's own data, maintains the semantic definitions that give those questions meaning, and governs how AI agents access data, seek approval and execute on the customer's infrastructure. Responsible AI is central to what we build, and the principles below describe how we approach it.
We design our technology to produce governed, repeatable and traceable results. Query compilation and execution are governed by explicit semantic definitions, business rules and access policies, and for a fixed data state, semantic configuration and permission context, a governed execution is designed to be reproducible. The interpretation of intent and the reasoning of AI models are not deterministic in the same way, so we subject them to validation, grounding against evidence, and oversight rather than treating a model's output as correct by default.
We keep people accountable for what our technology does. Sensitive actions remain subject to human approval. These include high-impact or irreversible actions, actions affecting financial or operational systems, changes to permissions or governed definitions, and agent actions with material consequences for a customer or an individual. Approval is risk-based and configurable, rather than every action requiring manual sign-off.
We manage the risks specific to AI systems. We ground answers in evidence to limit unsupported outputs, test and evaluate AI-generated results, protect against prompt injection carried in data, documents and tool outputs, enforce customer access controls and masking to prevent data leakage, consider bias and fairness risks in intended use cases, and evaluate the impact of material changes to the models we use. Our internal AI governance draws on recognised frameworks, including the NIST AI Risk Management Framework.
We do not use customer data, prompts, outputs or other customer-provided information to train or fine-tune models, or to improve generally available models and services for the benefit of other customers, unless the relevant customer authorises it in writing, and any authorised use is limited to the agreed purpose and scope. Non-identifying operational metadata, telemetry and security logs are handled separately and are not treated as customer data. We reserve the right to refuse or restrict deployments where our technology would be used for unlawful surveillance, discriminatory profiling, manipulation or other prohibited purposes, and we investigate suspected misuse rather than relying only on what is declared at onboarding.
12. Intellectual Property and Licensing
We respect the intellectual property rights of others. We review, track and comply with the licences that apply to what we build, including open-source software, third-party model weights, datasets, and third-party APIs and integrations, and we do not knowingly use code, content, models or data that we are not licensed to use. We respect the rights of our people and contractors in work they contribute, as set out in their agreements. We protect the intellectual property and confidential material that customers and partners share with us.
13. Service Availability and Business Continuity
We maintain business continuity and disaster recovery arrangements appropriate to the service we provide, including backups and documented recovery procedures, and we review and test these arrangements periodically, so that we can restore service and protect customer data after a disruption. Responsibilities for infrastructure resilience, backups and recovery are defined according to the deployment model, so for customer-managed and on-premises installations part or all of these responsibilities may sit with the customer. Specific availability targets and recovery commitments are set in the service level terms of the relevant agreement.
14. Confidentiality
We keep confidential the non-public information of our customers and partners, use it only for the agreed purpose, and disclose it only to those who need it and are bound by equivalent obligations. These duties continue after an engagement ends, in line with the relevant contract.
15. Third Parties and Subprocessors
We use a set of approved third-party providers and subprocessors to deliver our product, including cloud infrastructure, AI model providers and external integrations. We conduct appropriate due diligence before engaging a third party that may access company or customer information, bind them to confidentiality and data protection obligations no less protective than our own, and review their security, confidentiality and data protection practices periodically. We distinguish between vendors that process personal data on our behalf, subprocessors that process customer data on our behalf, and providers that do not access customer content, and we apply safeguards appropriate to each. We remain responsible for the parts of the service these parties support, disclose our subprocessors to customers as required by the relevant agreement, and reserve the right to end an engagement where a provider falls short and does not correct the shortfall.
16. Raising Concerns
We encourage our people, directors, contractors, customers and business partners to report suspected breaches of this Code or the law, unethical conduct, fraud, or conflicts of interest. Concerns may be raised through our designated reporting channel. We handle reports confidentially, to the extent reasonably possible and subject to legal and investigation requirements, and we review them promptly and impartially.
Anyone may raise a concern in good faith without fear of retaliation. Retaliation, intimidation or adverse treatment against a person who raises a genuine concern or takes part in an investigation is prohibited. Where a concern involves senior management or a member of the Board, it may be escalated directly to an independent director who is not involved, or to another designated independent channel, so that it reaches someone able to act on it. Following an investigation we take appropriate action, including disciplinary or contractual measures where warranted.
17. Governance and Review
Responsibility for this Code rests with our Board, and a member of management is designated to own its implementation. We make our people aware of the Code, provide periodic training, and ask employees and contractors to acknowledge it. We record and track reported breaches and report significant violations and the action taken to the Board. We review this Code at least once a year, and after any material change in law or in our operations, and update it as needed.
Violations of this Code may result in disciplinary action, up to and including suspension or termination of employment or engagement, subject to applicable law and contract. Where appropriate, a matter may be referred to the relevant regulatory or law enforcement authority. A violation by a contractor or third party may result in corrective action or the end of the business relationship.
18. Declaration
The Board of Alterbasics Technologies Pvt. Ltd. has adopted this Code of Conduct and Business Principles. We commit to upholding the standards set out in it across our business.
Approved by the Board of Alterbasics Technologies Pvt. Ltd. (Reference: ABT-COC-2026-01).
Contact
For questions about this Code of Conduct, or to raise a concern, write to us at dev@colrows.com or to Alterbasics Technologies Private Limited, Regency Orion, Baner, Pune, Maharashtra, India - 411045.