Where data lives
The service is operated from and hosted in India, in a data centre in Mumbai. If your users are in the EEA, the UK, Switzerland or the United States, their personal data is transferred to and processed in India. We state this plainly in the privacy policy. Executed Standard Contractual Clauses and a transfer impact assessment for EU and UK customers are in progress; if you need them before you can sign, ask, and we will tell you where they stand rather than imply they exist.
Enterprise customers who cannot accept that transfer can run the platform on their own infrastructure, including air-gapped, with feature parity.
What leaves your tenant
- Nothing to third-party AI providers. Smart selection, self-healing proposals, failure analysis and document intelligence run on local open-source models (Qwen, Apache-2.0 licensed; Llama 3.2 as a local standby on the non-security surface). No prompt, code or test data is sent to OpenAI, Anthropic, Google or Meta.
- Security scans send traffic to the target you verified, and only that target.
- Alerting integrations send the payloads you configure to the endpoints you configure, signed.
- Transactional email (verification, password reset, invitations) is sent through our mail provider.
Identity and access
- Passkeys (WebAuthn) and two-factor authentication for every account; SSO and SAML on Enterprise.
- Per-feature access grants. The ability to run active security scans is a separate grant.
- Active sessions are visible to admins and can be ended. A second-device sign-in ends the first session.
- Tenant isolation is enforced in the application and, as a second layer, by row-level security in the database.
Evidence for your reviewers
- A tamper-evident audit log of administrative and security-relevant actions, exportable.
- Evidence bundles on every confirmed security finding and VPATs generated from real accessibility scans.
- SOC 2-aligned controls, documented. We are not certified under SOC 2 and we do not print the badge. A certification audit is on the roadmap; ask us for the current control set.
- A vulnerability disclosure policy at /.well-known/security.txt with a monitored address, and a public status page.
Privacy rights and retention
Account holders can export and delete their data. Test data generated by the Test Data Factory is synthetic, so you do not need production personal data in staging to use the platform. Retention periods per data class are enforced in the database and described in the privacy policy. India's Digital Personal Data Protection Act is the primary regime we operate under; GDPR obligations apply to EU users and are handled through the same rights workflows.
Questions we get on security questionnaires
- Encryption in transit: TLS. Encryption at rest: credentials and stored auth state are encrypted; the database volume is on the provider's managed storage.
- Backups: daily encrypted backups with a weekly automated restore drill that checks the restored database against production.
- Sub-processors: the hosting provider (Mumbai) and the transactional email provider. Ask for the current list.
- Penetration testing of the platform itself: every release passes our own security scanner and regression gates. A third-party penetration test is planned; we will say here when it has happened, not before.
Questions people ask about this
- Can we get a DPA?
- Yes, on request, and we will be explicit about the transfer mechanism section rather than leaving it vague.
- Do you train models on our data?
- No. The local models are used for inference only. No customer data is used to train or fine-tune any model.
Source: /documentation/security-and-data-handling, updated 2026-09-16. Answers are checked against the shipped product on that date.
Found something out of date? The people who build the module answer the contact form on the home page, and corrections to this guide are dated above. Tell us.