/ Security & Compliance
We are a security company. Our own posture comes first.
A fraud platform holds some of the most sensitive data an institution has. Here is exactly how we protect it, where it lives, and which certifications we are working toward.
/ Controls
How the platform is secured.
Encryption everywhere
AES-256 at rest with envelope encryption and managed key rotation; TLS 1.3 for all data in transit, including internal service-to-service traffic.
Tokenisation
Card numbers, account identifiers and personal identifiers are replaced with format-preserving tokens before they reach analytics or model training paths.
Data localisation
Production data, backups and logs stay inside AWS Mumbai (ap-south-1). No cross-border replication of customer data.
Least-privilege access
Role-based access, mandatory MFA, just-in-time elevation and full session logging for every production action.
Secure SDLC
Peer review, dependency and secret scanning in CI, and periodic third-party penetration testing on the platform and APIs.
Resilience
Multi-AZ deployment, encrypted point-in-time backups and a documented, exercised incident response plan.
/ Defence in depth
Four layers, not one perimeter.
Scroll through the stack: each control layer of the vault lights up as you pass it, from encryption at the outer shell to immutable audit logging at the core.
- EncryptionLayer 1
- TokenizationLayer 2
- Access controlLayer 3
- Audit loggingLayer 4
/ Certification roadmap
Published, not promised.
We would rather show you the current state than imply a badge we have not earned.
ISO 27001
In progressISMS scoped across engineering, operations and data handling; internal audit underway.
SOC 2 Type II
In progressTrust services controls implemented; observation window planned post-ISMS certification.
PCI-DSS
Architecture awareWe avoid storing PAN data outright; tokenisation and scope reduction are designed in from day one.
DPDP Act, 2023
AlignedConsent capture, purpose limitation, breach notification and data principal rights workflows.
/ Due diligence
Running a vendor assessment?
We share our security architecture documentation, data flow diagrams, sub-processor list and pen-test summary under NDA.