How we handle your data.

JWT access + refresh tokens scoped per appId (multi-tenant)

Token refresh protected by a 5-second dedup mutex

Phone OTP, WhatsApp OTP, magic-link, passkey/WebAuthn, OAuth (Google/Apple/Facebook)

Per-tenant role-based access control

Google Cloud Run in asia-south1 (Mumbai) — India data residency

MongoDB Atlas as system of record

AES-256-GCM field-level encryption on Aadhaar / PAN PII

TLS on every connection; the marketing site and app edges sit behind Cloudflare

X-App-ID + X-API-Key required on every authenticated route

JWT-derived userId enforced server-side (no client-supplied identity)

Payment webhooks verified with HMAC-SHA256 and a constant-time compare

Per-mobile and per-IP rate limiting on OTP send/verify endpoints

11,600+ automated tests across the foundation modules, SDK and server

DPDP Act 2023 alignment — DPO contact published, breach process documented

GST-compliant invoicing and 7-year retention on financial records

IT Act 2000 alignment + Apple/Google data-safety disclosures filed per app

Public API surface gated by app-level JWT plus a per-tenant appId

Enum and payload decoding is fail-safe — unknown server values cannot crash a client

Production secrets injected as Cloud Run environment variables, never written to disk or committed

Migrations fail loudly rather than dropping and recreating tables

Best-effort availability. We publish no uptime percentage and offer no SLA

Cloud Run rolling deploys with revision rollback in minutes

Offline-first SDK — clients keep working through transient outages

MongoDB Atlas automated backups with point-in-time recovery

No SOC 2, ISO 27001, or third-party penetration-test report

Single primary region — no multi-region failover

No public status page or measured availability history

Certificate pinning ships in the SDK but is opt-in, not on by default