What is true today, stated plainly
We would rather you read this here than find it in a questionnaire. This page is updated whenever the posture changes.
Where things stand
Where the data lives
Live records, search index, conversations and logs rest in India (DigitalOcean Bengaluru) for Indian customers, with encrypted backups and the audit anchor also in India. Malaysian customers are served from Singapore. UAE customers on the dedicated edition run on an in-country cloud.
Two steps we name. Today, embedding and generation for Sutradhar use external model endpoints with published no-retention terms; both are disclosed on the sign-in screen and in the compliance console. An in-region inference option ships for the dedicated edition in Q4 2026, after which no employee data leaves the region on that tier.
Assurance status
- Two structured internal security reviews completed; 21 of 29 confirmed findings closed, the remaining eight documented with owners
- Independent CERT-In empanelled VAPT: scheduled Q4 2026
- SOC 2: not audited; Type 1 scoped for 2027
- Processor agreements and sub-processor list available; DPAs with model providers being put in place
- Backups installed and restore-proven; hash-chained audit log per tenant
Tenant isolation
Every table tenant-scoped; row-level security forced in Gargi; composite tenant foreign keys in Margdarshak; cross-tenant leak tests in CI. Own logical database and role per product. Dedicated edition: same images, one tenant, your region.
Data protection by construction
Lawful basis per person per purpose; consent per channel and notice version; retention enforced nightly; access and erasure implemented and tested; one erasure across every product; exportable evidence pack.
The deterministic boundary
Models propose and write; Python decides. No model output can ingest data, select a person, compute a number, or set disclosure. A masked profile — never a raw row — is the most a model sees of your source data.
What we do not claim: a deflection rate, a cost saving or an ROI figure measured on live traffic (Phala exists to earn that claim honestly); SOC 2 compliance; an independent penetration test result; that no data leaves India on the shared edition today.