Data Retention & Security
Working draft — pending review by qualified Indian legal counsel. It is not yet a binding policy, and highlighted [PLACEHOLDERS] will be filled before launch.
How we protect data and how long we keep it.
Security controls
- Private storage for documents, with no public links; every access is recorded.
- Encryption in transit; two-factor sign-in for all staff; least-privilege access with prompt revocation.
- Separate test and production environments; real identity documents are never used in testing.
- An append-only audit log of document access, decisions, moderation, appeals, exports and staff changes.
- Rate limiting, secure password and session handling, backups and restore tests.
Retention schedule (draft)
- Account records: [PERIOD]
- Verification evidence: up to 365 days after the check (working draft) — final period [PERIOD]
- Complaints and appeals: [PERIOD]
- Reviews (if enabled): [PERIOD]
- Audit and security logs: [PERIOD]
- Backups: [ROTATION AND EXPIRY]
If something goes wrong
We contain the problem, preserve the necessary logs, assess what was exposed, involve our security lead and legal counsel, and follow the notification obligations that apply. We record the root cause and corrective action.