Security at AuditSahi.

Your data stays in India

Our server is in Mumbai. Your account, your organisations, the text of the documents you upload and every verdict are stored there. Documents are read by two AI models on Amazon Bedrock in Amazon Web Services' Mumbai region, and a request to send your organisation's text to a model outside India is refused by the product itself. The companies that make the models never see your text, and our Amazon account is set to keep none of it. The full detail is in the privacy notice.

Who can see what

• An organisation is visible only to the account that created it. Every page and every request checks this, so one customer cannot reach another's records.
• Administrators at O Square Technologies can open a customer's organisation only after signing in with two-step sign-in, and every such visit is recorded with who and when, so we can tell you if anyone at AuditSahi looked at your records.
• The connection for your own AI agents reads only your own organisations, read only, with tokens you create and can revoke.
• Links you send a client or your staff open only after a code is emailed to the person named, show only what that person needs, and can be turned off at any time. Nothing a client sends is used until you accept it.

Accounts and sign-in

• Passwords are stored only as salted scrypt hashes. Session cookies, agent tokens and link tokens are stored only as one-way hashes, so a copy of our database could not be used to sign in as anyone.
• Two-step sign-in with an authenticator app is available to every account, with recovery codes.
• Repeated wrong passwords are slowed down, and a forgotten password is reset with a code sent to the account's email.
• Every page is served over HTTPS only, with strict browser protections against framing, injected scripts and content sniffing.

Documents and backups

• An uploaded file is deleted as soon as its text has been extracted; we keep the text and its verdicts.
• The application runs as an unprivileged user in a read-only container that can write only to its own data folder.
• The database is copied every night, compressed and encrypted.
• Deleting a document, an organisation or your account removes it at once. Encrypted backup copies roll off within 30 days.

We never scan your systems

AuditSahi works only from the documents and answers you give it. It never connects to, scans, probes or tests any of your systems.

If something goes wrong

We follow a written incident and breach procedure. When we notice or are told of an incident:

• we report it to CERT-In within six hours, as the CERT-In Directions of 28 April 2022 require;
• we tell every customer whose data may be affected within four hours of suspecting it, and at once when it is confirmed, with what happened, what was involved, what we have done and what you should do;
• where personal data is breached, we notify the Data Protection Board of India and the people affected as the DPDP Act and Rules require;
• we keep the logs and evidence, find the cause, close it, and tell you what changed.

Our Point of Contact for CERT-In, and our grievance officer, is Kunal Sarin, Proprietor, O Square Technologies.

Being completed

We would rather tell you than have you find out. These are under way:

• moving AuditSahi to its own dedicated server on Amazon Web Services in Mumbai, with access only through named, logged sessions;
• a copy of every backup in a second Indian region, Hyderabad, encrypted so that only we can open it;
• keeping web and system logs for 180 days, as the CERT-In Directions require;
• an independent penetration test of AuditSahi by a CERT-In empanelled auditor.

Report a security issue

If you think you have found a weakness in AuditSahi, write to support@auditsahi.com with "Security" in the subject. Please give us a chance to fix it before telling anyone else, and do not access or change other people's data while looking. We will reply and keep you informed.