Built to protect what matters most
Priraksha is designed from the ground up to handle sensitive personal data under India's DPDP Act 2023. Every architectural decision — from data residency to access controls — reflects that responsibility.
India-only data residency
All personal data processed through Priraksha is stored exclusively on cloud infrastructure within India. No data crosses international borders. This satisfies DPDP Act requirements and eliminates cross-border transfer risk entirely.
Encryption at rest and in transit
Data at rest is encrypted using AES-256. All data in transit is protected by TLS 1.3. Encryption keys are managed through a dedicated key management service with automatic rotation and audit logging.
Zero-trust access architecture
Every internal service call is authenticated and authorised independently. No implicit trust between components. Role-based access control (RBAC) governs all human access, with least-privilege enforced by default.
Immutable audit trails
Every consent event, rights request, breach notification, and administrative action is written to an append-only audit log. Logs cannot be modified or deleted — they are your evidence pack for the Data Protection Board.
Breach detection and response
Continuous anomaly detection monitors for unusual access patterns, data exfiltration signals, and authentication failures. Automated alerting triggers the incident response workflow within minutes of detection.
Vendor and sub-processor controls
All sub-processors are contractually bound to the same data protection standards. A current sub-processor register is maintained and available on request. No sub-processor may access customer data without explicit authorisation.
Your data never leaves India
Priraksha operates exclusively on cloud infrastructure hosted within Indian data centres. No personal data is transferred internationally — not for processing, not for backup, not for analytics. This is not a configuration option; it is a hard architectural constraint.
Compliance and assessments
Priraksha undergoes regular independent security assessments. Certification roadmap is aligned with DPDP Act obligations for Significant Data Fiduciaries.
ISO 27001 (in progress)
Information security management system certification. Target completion aligned with DPDP enforcement date.
Annual penetration testing
Independent third-party penetration tests conducted annually. Findings are remediated and verified before each test cycle closes.
VAPT assessments
Vulnerability Assessment and Penetration Testing performed on all production systems and APIs. Reports available to enterprise customers under NDA.
DPDP Act 2023 alignment review
Internal legal and technical review against all DPDP Act obligations and Draft Rules 2025 requirements, updated as rules are finalised.
How we handle your data
What data does Priraksha store?
Priraksha stores consent records, rights request logs, breach notification records, and audit trails on behalf of your organisation. We do not store the underlying personal data of your Data Principals beyond what is necessary to operate the compliance workflow.
Who can access our data?
Access is restricted to authorised personnel in your organisation via RBAC. Priraksha engineering staff have no standing access to customer data. Emergency access requires a formal approval workflow with full audit logging.
How long is data retained?
Consent records and audit logs are retained for the period you configure, subject to a minimum of 3 years to support regulatory investigations. Data is securely deleted at the end of the retention period using cryptographic erasure.
What happens if Priraksha is breached?
We follow the same 72-hour notification obligation we help you meet. Affected customers are notified immediately with full incident details. Our incident response plan is tested annually and available to enterprise customers on request.
Deployment and infrastructure
Priraksha is multi-tenant by design. Each customer is isolated inside a shared database by PostgreSQL FORCE ROW LEVEL SECURITY — a hard, server-enforced access rule that cannot be bypassed by application code. For customers who require stronger isolation, dedicated and on-premises tiers are available.
Tier 1 — Shared SaaS
PostgreSQL FORCE RLS — customers separated by enforced row-level access rules inside a shared database
SMEs, schools, retail, logistics
Tier 2 — Dedicated Stack
Separate VPC, dedicated PostgreSQL instance, and customer-managed KMS keys — deployed on your AWS account
Hospitals, financial firms, large enterprises
Tier 3 — On-Premises
Complete air-gap — Docker images and Terraform / Helm charts handed over; you run the stack in your own environment
Banks, insurers, government bodies
PostgreSQL on private EC2 — what you should know
The default Shared SaaS infrastructure runs PostgreSQL on a single private EC2 instance with AES-256 encrypted disk, TLS-enforced connections, and automated daily backups to S3. The README documents that this configuration has no automatic failover. High-availability PostgreSQL is available as an add-on for Dedicated Stack customers and is recommended for production workloads above 10 lakh records.
Related documents
Security questions before you commit?
We welcome security reviews, questionnaires, and technical due diligence. Enterprise customers can request our full security documentation pack.
Request Security Documentation