Family wealth data is among the most sensitive personal information a person holds. We design the Platform around the assumption that any single layer of defence will eventually fail, so each layer is hardened and tested independently.
Encryption — two-tier key hierarchy
All sensitive personal data is encrypted at rest using AES-256-GCM under a two-tier key hierarchy:
- Family Data Encryption Keys (DEKs) — one per family. Used to encrypt the actual records (assets, holdings, will drafts, AIS imports, etc.).
- Platform Key Encryption Key (KEK) — wraps every DEK. The KEK lives only in Cloudflare's secret store; it is never written to a database.
A compromise of the database alone does not expose plaintext — DEKs in the database are wrapped, and the KEK is not in the database. A compromise of the KEK alone does not expose any single family's data either, because the wrapped DEK is needed too.
Transport security
- TLS 1.3 from your device to our edge — enforced; older versions rejected.
- HSTS preload, plus a strict Content-Security-Policy on the app surface.
- Same-site, HTTP-only, secure cookies for session tokens. CSRF tokens on every state-changing request.
What we never store in plaintext
- Full PAN — only the last 4 digits are kept in plaintext for display; the full PAN is encrypted with the family DEK.
- The full 12-digit Aadhaar — never. We store a derived reference only when strictly needed for KYC matching.
- Full bank account number — last 4 digits visible; the rest is encrypted.
- Card numbers — we don't take card payments directly; payment is via a PCI-DSS-compliant provider.
- Passwords — only Argon2id hashes, never the password itself.
Data residency
Personal data is processed and stored in India. Cloudflare's Asia-Pacific edge may serve cached static assets globally, but our Workers KV, D1 databases, Durable Objects, and R2 storage are pinned to APAC India regions.
Logging and monitoring
Per CERT-In Cyber Security Directions, 2022, we maintain structured logs of all requests to the Platform — timestamp, request id, hashed user id, route, status, latency, and client metadata — for at least 180 days, in India. Logs are write-only from the application, and access is restricted to incident response.
Time synchronisation
Server clocks are synchronised via Cloudflare's NTP infrastructure, which is aligned to authoritative time sources. CERT-In Directions, 2022, require time sync to NIC / NPL clocks; if a regulated partner asks for direct NPL alignment, we add a sidecar.
Incident response
- If an incident affecting personal data occurs, we report it to CERT-In within 6 hours per the 2022 Directions.
- We notify affected users without delay in plain language — what happened, the likely impact, what we did, and how to contact us — per the DPDP Act (Digital Personal Data Protection Act, 2023) Rules, 2025.
- We notify the Data Protection Board of India per the timelines and form prescribed under the DPDP Act once the Board is operational.
Responsible disclosure
If you find a vulnerability, please report it to
[email protected] with
subject line starting [Security]. Please do not publicly disclose
until we have had reasonable time to fix it. We acknowledge within 48 hours and
aim to resolve within 30 days. We do not currently run a paid bug-bounty
programme but will credit researchers in our security hall of fame.
Sub-processors
We use a small set of sub-processors. Each is bound by data-protection terms. The current list:
- Cloudflare Inc. — hosting, edge compute (Workers), KV, D1, R2 storage, durable objects, secret store.
- Resend — transactional email (OTP, account notifications).
- Partner Account-Aggregator infrastructure — only when you are a B2B2C user of a partner who has supplied FIU credentials, and only for the AA flow you initiate.
Sub-processor changes are notified via email and the in-app feed at least 30 days before they take effect.
Audits and certifications
Formal ISO 27001 and SOC 2 certification is on our roadmap. We will publish certificates on this page when issued. In the interim, we run internal quarterly reviews against the ISO 27001 control set and welcome partner-led audits under NDA.
Contact
Security questions: [email protected]. Grievances: Grievance Redressal.