Home › Legal › Security Statement
Security Statement
Last updated: 25 October 2026 · Version 1.0 · Owner: Mr. Vikas Saini, Director (Technical)
Version history: v1.0 — 25 October 2026 (initial publication). v1.1 — 25 October 2026 (audit fixes). See /legal/CHANGELOG.md.
Hindi summary available. Yeh dastaavez English me legally valid hai. Hindi summary PDF request karein.
Our honesty principle. This document separates what is in place today (Live) from what is planned (Planned). We think insurance company reviewers trust an honest “here’s what we don’t have yet, here’s when we will” more than a glossy brochure. If you need evidence for any item, email security@digitaliiisla.co.in.
1. Encryption
- Live At rest — database. AES-256 encryption on Supabase Postgres storage volumes (ap-south-1).
- Live At rest — media. AES-256 server-side encryption on all three storage tiers: Supabase Storage (ap-south-1 Mumbai), Cloudflare R2 (edge-cached), and AWS S3 Mumbai (ap-south-1 archival). India-resident copy is maintained at Supabase Storage + AWS S3 Mumbai at all times.
- Live In transit. TLS 1.3 enforced on all public endpoints (Cloudflare TLS termination, min version pinned). HSTS with 1-year max-age and preload submission.
- Live Backups. Database dumps written to Backblaze B2 are additionally GPG-encrypted (AES-256) with a passphrase held only by Digitaliiisla — a full compromise of the backup bucket reveals nothing readable.
- Live Passwords. Argon2id hashing (Supabase default) — the plaintext password is never visible to Digitaliiisla or to Supabase.
- Planned Q2 2027 Field-level encryption for the most sensitive columns (insured mobile, policy number) with keys held in Cloudflare Workers KV under customer-held master keys.
2. Access control
- Live MFA mandatory for every Digitaliiisla employee / contractor accessing production (Supabase admin, Cloudflare dashboard, Razorpay dashboard, Backblaze console). TOTP enforced; SMS-OTP not accepted.
- Live Row-Level Security (RLS) on every Supabase table that holds survey data — a surveyor’s session can read only their own rows, enforced at the database layer. No application-layer scoping bug can bypass this.
- Live Least-privilege roles. Four production roles (admin / support / read-only / none) assigned per employee. Default is none.
- Live Break-glass access to raw tables is session-logged, Slack-alerted, and reviewed weekly against a ticket.
- Live Audit logs. Supabase SQL audit, Cloudflare access logs, application-level access-log tables — retained 18 months rolling.
- Planned Q1 2027 SSO for enterprise insurer tenants (SAML / OIDC) with just-in-time provisioning.
3. Infrastructure
- Live Supabase Pro — ap-south-1 (Mumbai) — SOC 2 Type II attested platform. Primary data (database + storage) stays in India.
- Live Cloudflare R2 — hot-tier object storage for edge-cached media delivery to Indian POPs; SOC 2 Type II attested.
- Live AWS S3 Mumbai (ap-south-1) — India-resident archival copy of long-retention records for IRDAI 7-year audit tail; server-side encrypted + client-side AES-256 before upload. India-only replication.
- Live Cloudflare — Workers for routing & edge logic, WAF rules for OWASP Top-10, DDoS protection (Advanced Rate Limiting), bot management on login endpoints.
- Live Data residency. All primary tenant data is stored on India-based infrastructure. Only transient OCR calls traverse Google Gemini (India / US) and transactional email traverses Resend (EU / US). No survey content is retained outside India.
- Live Network isolation. Supabase project uses private network peering for admin access; direct database port (5432) is firewalled.
- Live Secrets management. Secrets live in Cloudflare Worker “encrypted variables” (Workers Secrets); never in source control. Secret-scanning on every commit (truffleHog + github push-protection).
4. Backup & disaster recovery
- Live Daily automated backups — full database dump + media mirror pushed to Backblaze B2 (India dual-region) every night at 02:00 IST.
- Live Backup encryption: GPG AES-256; passphrase stored in Cloudflare Worker secret and in an offline sealed envelope held by the Directors.
- Live RTO: 4 hours to restore the live database and the media tree from Stage 2 backup.
- Live RPO: 24 hours worst case (nightly backup cadence). Point-in-time recovery for the last 7 days through Supabase PITR.
- Planned Q1 2027 Semi-annual DR drill: rehearsed restore from Backblaze into a clean Supabase project, measured end-to-end — results published to enterprise customers under NDA.
- Live Immutable deletion log: every row delete is captured by a DB-side trigger with the full before-image, the user id and request headers, retained 7 years. Any accidental or malicious deletion is reversible without restoring the whole database.
5. Incident response
- Live 24/7 pager rotation through PagerDuty / phone escalation to Directors.
- Live Internal detection target: < 24 hours from first signal (anomaly in error logs, Cloudflare WAF event, Supabase audit alert, user report).
- Live Regulator notification: 72 hours to the Data Protection Board of India per DPDPA.
- Live Enterprise-customer notification: 24 hours contractual obligation under the DPA.
- Live Public post-mortem for every High-severity incident, published at /legal/breach-notification.html.
6. Vulnerability management
- Live Dependency scanning: GitHub Dependabot on every repository — critical CVEs patched within 7 days; high within 30.
- Live Automated scans: quarterly OWASP ZAP + Lighthouse security audits against the production environment.
- Planned Q1 2027 Annual third-party penetration test by a CERT-In empanelled auditor — scoped against the DigiSurvey application + Cloudflare Workers. First engagement scheduled, not yet executed. Report will be summarised in this document and the full report shared under NDA.
- Live Responsible disclosure: security@digitaliiisla.co.in — good-faith reports acknowledged within 24 hours and acknowledged publicly in the Hall of Fame.
- Planned Q2 2027 Bug bounty programme (closed-invite phase first; public phase after one clean year).
7. Employee & contractor security
- Live NDA on every employment / contractor agreement; survives engagement.
- Live Background checks for admin-tier access (identity, education, criminal record). Managed by HR via a licensed verification agency.
- Live Mandatory annual security training — phishing simulation, DPDPA, incident response. Attendance tracked.
- Live Device policy: company-managed laptops for admin access; full-disk encryption; MDM; auto-lock; auto-wipe on > 10 failed logins.
- Live Off-boarding checklist — same-day revocation of Supabase, Cloudflare, GitHub, Google Workspace, Razorpay, Backblaze access on exit.
8. Secure development
- Live Mandatory code review on every PR before merge to main.
- Live Automatic deploys via Cloudflare Workers Builds on push to main; staging and preview environments for every PR.
- Live Secret-scanning on commits (GitHub push-protection + truffleHog); rotated immediately on any leak.
- Live Dependency scanning Dependabot + GitHub Advanced Security code-scanning.
- Live Security-focused design review for any change touching auth, PII flow or payments.
- Planned Q2 2027 Static analysis with Semgrep rules tuned for Postgres RLS leakage patterns.
9. Sub-processor assessment
- Live Annual review of each Sub-processor’s SOC 2 attestation; first cycle completes October 2027 / ISO 27001 certificate / data-residency commitments.
- Live DPA on file with each Sub-processor; terms summarised at /legal/subprocessors.html.
- Live Change notification — 14 days before any addition or replacement, as per our DPA with customers.
10. Business continuity
- Live Uptime target: 99.9% (Supabase Pro + Cloudflare multi-region).
- Planned Q1 2027 Public status page at status.digitaliiisla.co.in — incident timeline + historical uptime.
- Live Zero-single-point-of-failure for data: live → nightly backup to a different provider → immutable row-level deletion log (three independent stages described in the Privacy Policy).
- Live Succession: two Directors (Mrs. Monika Sharma & Mr. Vikas Saini) each hold the full secret envelope; either can execute restore & business operations.
11. Insurance cover
- Live Directors’ & Officers’ (D&O) liability insurance in force.
- Live Cyber liability insurance in force — policy limits available to enterprise customers under NDA.
- Live Professional indemnity covering the Company’s technology service to IRDAI-licensed Surveyors.
12. Certifications & attestations — current status
We maintain an honest view of what we have and what we don’t:
| Certification | Status | Notes |
|---|---|---|
| SOC 2 Type I | Target Q4 2027 | Scoped against DigiSurvey. We rely in the meantime on our Sub-processors’ SOC 2 and on contractual commitments in this Statement. |
| SOC 2 Type II | Target Q4 2028 | Follows the Type I observation window. |
| ISO 27001 | Target 2028 | Dependent on headcount growth and formal ISMS roll-out. |
| IRDAI Information & Cyber Security Guidelines | Aligned | Self-attested alignment with the controls checklist; evidence available under NDA. |
| DPDPA 2023 Significant Data Fiduciary readiness | Not notified | Digitaliiisla has not been notified as a Significant Data Fiduciary; we meet the general Data Fiduciary obligations. |
| CERT-In cyber-security directions (6-hour reporting) | In progress | CERT-In portal registration — target completion November 2026. 6-hour incident-reporting duty acknowledged and process documented in Breach SOP §6; incident channel incident@cert-in.org.in + phone 1800-11-4949 ready. |
13. Contact
Security disclosures & questions: security@digitaliiisla.co.in
Breach reports (24/7): security@digitaliiisla.co.in + phone +91 83026 98307
Enterprise customer questions: your account manager, or legal@digitaliiisla.co.in