Our security posture, in the open.
This page is deliberately honest. We list what is live in production today, what is being audited, and what is on the roadmap with dates. No badges we did not earn. When we get a certification, this page will link the actual report.
Controls you can verify today
These are the controls a customer or auditor can validate against dcomply right now. No promises, no roadmap. Live.
AES-256 encryption at rest
All customer data on our servers, including database backups. Encrypted using AES-256 with per-tenant key derivation. Sensitive PII fields (IP address, user agent, parent email, parent phone) use column-level AES-256-CBC encryption via APP_KEY.
TLS 1.3 in transit
All browser-server and API traffic is TLS 1.3 with HSTS enforced. SSL Labs A+ grade. No legacy cipher fallback. Certificates auto-renewed 30 days pre-expiry.
India data residency
Primary infrastructure hosted in India. Backups replicated within India-only availability zones. No cross-border data transfer by default. Complies with the DPDP Sec. 16 Central Government notification framework.
Role-based access control
Fine-grained RBAC across super-admin, tenant-admin, tenant-user, client, and data-principal roles. Multi-tenancy isolation enforced at the Eloquent global scope level (BelongsToClient trait). Every controller enforces tenant scoping.
EvidenceChain hash-chained audit
Every consent, DSR, breach, DPIA sign-off, and connector event is written to a SHA-256 hash-chained ledger. Verifiable offline against the DPBI export bundle. Full architecture →
Append-only audit tables
source_evidence_entries, breach_audit_logs, dsr_audit_logs, and consent_purpose_logs accept INSERTs only. No update or delete path exists in application code. Enforced by the migration schema.
HTTP security headers
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy tightened. Enforced across every response.
Session & CSRF protection
Laravel Sanctum session cookies with SameSite=Lax, Secure, HttpOnly. CSRF tokens on every state-changing request. IP-tracked sessions. Auto-timeout after 90 minutes of inactivity.
Backup & point-in-time recovery
Automated hourly DB snapshots retained 30 days, daily snapshots retained 90 days. Point-in-time recovery to any second in the last 24 hours. RPO under 1 hour, RTO under 4 hours. Restore drills quarterly.
Roadmap with dates, not badges
Most competitor trust pages list certifications they cannot back on request. We publish our roadmap with target dates instead. When we complete an audit, this page will link the actual report.
We are not currently SOC 2 Type II certified. We are not currently ISO 27001 certified. We are not currently a registered DPDP Rule 4 Consent Manager (nobody is yet in India, but every vendor listing this claim today is misrepresenting). We will link the actual report on this page when each becomes real.
Security practices you can question
Development & deployment
- Code review by second engineer required for every merge to main
- Automated SAST scanning on every push (findings block merge on critical)
- Composer & NPM dependency audit on every build; critical CVE within 24 hours
- Staging environment mirrors production; no test data with real PII
- Zero-downtime deploys with automatic rollback on health-check failure
- All migrations reviewed for reversibility and lock timing
People & access
- Background verification for every team member with production access
- MFA required on every internal system (workspace, Git, cloud console)
- Principle of least privilege enforced through role-scoped IAM
- Quarterly access review with revocation of unused permissions
- NDA and confidentiality clauses in every employment contract
- Security awareness training on join and refresher every 6 months
Infrastructure & monitoring
- Network segmentation between web tier, app tier, and database tier
- Web application firewall with rate limiting on the public edge
- Intrusion detection system on the network perimeter
- Centralised logging with 90-day retention; log integrity SHA-256 checksummed
- Real-time alerting to on-call rotation for anomalies
- Public status page at status.dcomply.in (in build)
Incident response
- Documented runbook covering detection, containment, eradication, recovery
- On-call engineer paged for every priority-1 signal
- Customer impact notified within 4 hours of confirmed incident
- CERT-In 6-hour reportable-incident workflow templated
- DPBI Sec. 8(6) 72-hour notification workflow templated with live countdown
- Post-mortem published to affected customers within 14 days
Incident history, in the open
The list a vendor's trust page will not usually show. We publish every P1/P2 incident since dcomply went live, with the RCA link. When there is nothing to report, the list is short. That is the goal.
Subscribe to [email protected] for material-change notifications on this page.
Found a vulnerability? Please tell us.
We welcome vulnerability reports from the security research community. Email [email protected] with reproduction steps. We will acknowledge within one business day, triage within three, and coordinate a fix window. Public credit given on request. No legal action for good-faith research within our safe-harbour scope.
Our commitments to researchers
- Acknowledge within 1 business day
- Triage within 3 business days
- Coordinated disclosure window agreed jointly
- Public credit if you want it
- Safe-harbour clause for good-faith testing
- Bounty program launching Q1 2027
Want the deep tour?
Enterprise buyers get access to our security whitepaper, control matrix, and pentest attestation letter (once the Q4 2026 test is complete).