Security & privacy
Your borrowers’ data stays yours.
A private model per tenant, encryption end to end, and every read on the record. Built to answer the questions your CISO and your auditors will ask.
- Encryption in transit
- TLS 1.3
- Encryption at rest
- AES-256
- Key management
- Customer-managed
- Authentication
- SSO + MFA
- Authorisation
- RBAC + row-level
- Audit logging
- Every read & write
- Backups
- Encrypted, geo-redundant
- Penetration testing
- Quarterly, third-party
- Vulnerability scanning
- Continuous
- Incident response
- 24/7 SOC
For your CISO
Five questions, answered before you ask them.
01
Where does our data go?
Nowhere you haven’t agreed to.
- A private LLM per tenant. Files never reach public models.
- No cross-customer mixing.
- Indian deployments are hosted in the Mumbai region. No data crosses borders unless explicitly contracted otherwise.
02
Will our files train your model?
No.
- Customer data never trains or fine-tunes models. Improvements come from synthetic and public data.
- Prompts and files are processed on a tenant-scoped instance only.
03
Is it encrypted?
In transit, at rest, and per field.
- TLS 1.3 in transit, AES-256 at rest.
- Customer-managed keys available.
- Field-level encryption for PII.
04
Who can see what?
Only the people you allow, with a reason on record.
- SSO and MFA, with a recorded reason per read.
- Role and row-level permissions.
- Auditors can see everything but can’t write.
05
Can we prove it to an auditor?
Every check is sourced and timestamped.
- Every API call, invocation and alert is logged.
- Audit packs on demand, in RBI format.
- Encrypted, geo-redundant backups.
Certifications & frameworks
Evidence, not promises.
ISO/IEC 27001
Information-security management system, audited annually by an accredited certification body.
RBI Digital Lending Guidelines
Compliant with the RBI Digital Lending Guidelines from day one.
Account Aggregator
Consent-based data fetch via Setu and Finvu. Every pull is consent-recorded and revocable.
DPDP Act, 2023
Purpose limitation, minimisation, breach notification, deletion on request.
Hand your CISO the full security pack.
Architecture diagrams, data-flow specs, audit reports and certification documents, shared with your security or risk team in one call.
Book a demo →