Radical Transparency
Trust & Compliance Posture
We believe in complete honesty. Here is our exact, verified compliance status across Indian regulatory frameworks and international security standards.
Regulatory & Security Compliance Matrix
Last updated: October 2026 • Verified by InfoSkills Technology Security Office
| Framework / Law | Category | Status | Scope & Controls |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 (DPDP Act) | Indian Privacy Law | Implemented | Consent notice architecture, purpose limitation, verifiable parental consent hooks, Data Subject access & erasure workflows, designated Grievance Officer. |
| India Data Localization (RBI / MeitY) | Regulatory | Implemented | 100% of databases, Redis caches, S3 document storage, and worker queues reside exclusively within AWS ap-south-1 (Mumbai, India). |
| Information Technology Act, 2000 & SPDI Rules | Indian IT Law | Implemented | Reasonable security practices and procedures for sensitive personal data or information (SPDI) under Section 43A of the IT Act. |
| OWASP Application Security Verification Standard (ASVS 4.0) | Technical Security | Implemented | Level 2 architecture controls: Ed25519 asymmetric token validation, Argon2id password hashing, AES-256-GCM encryption at rest, SSRF guard, brute-force lockout. |
| EU General Data Protection Regulation (GDPR) | Global Privacy | Implemented | Standard Contractual Clauses (SCCs), Data Processing Addendum (DPA), Article 15-20 data export & right to be forgotten APIs. |
| ISO/IEC 27001:2022 Certification | Information Security Management | In Progress (Target Q3 2026) | Formal Information Security Management System (ISMS) implementation underway with external accredited audit firm. Policies and asset inventory drafted. |
| SOC 2 Type II Examination | Trust Services Criteria | In Progress (Target Q4 2026) | 6-month audit observation period planned with independent AICPA CPA auditor for Security, Availability, and Confidentiality criteria. |
| PCI-DSS SAQ-A Compliance | Payment Security | Delegated & Compliant | Cardholder data is never touched or stored by AuthSetu servers. All payment transactions are handled directly via Razorpay PCI-DSS Level 1 certified checkout. |
RFC 9116 security.txt
We publish a standardized, machine-readable security contact policy file in accordance with RFC 9116 for security researchers and automated tools.
Responsible Disclosure Safe Harbor
We welcome security research from ethical hackers. We commit not to initiate legal action against researchers acting in good faith without degrading service availability or accessing unauthorized customer data.