AUDTTrust CenterSign in

Data Protection

AUDT treats data protection as an architectural guarantee, not a policy. Tenant isolation, Row-Level Security, and India data residency are enforced at the infrastructure layer.

India Data Residency

All customer data — primary database, file storage, and compute — is located in India. This directly supports compliance with India’s DPDP Act 2023, RBI Circular on IT Governance, and SEBI CSCRF requirements for data localisation.

Database
Supabase Postgres — AWS ap-south-1 (Mumbai)
File storage
Supabase Storage — AWS ap-south-1 (Mumbai)
Application compute
Vercel bom1 region (Mumbai)
AI processing
Gemini API — data not retained by Google

Row-Level Security on Every Table

PostgreSQL Row-Level Security (RLS) is enabled on all 259+ tables. No application code path can return data from a different organization. The enforcement happens inside the database engine before any row is returned to the application layer.

  • RLS enabled on all 259+ tables — without exception
  • Custom PL/pgSQL helpers: is_org_member() and has_org_role() on every policy
  • Junction tables validated via EXISTS subqueries, not joins
  • Global catalogue rows (frameworks, regulations) use OR organization_id IS NULL
  • Enforced at PostgreSQL level — cannot be bypassed from application code

Tenant Isolation

AUDT is a multi-tenant SaaS platform. Each customer organization is a separate tenant with its own isolated data space. There are no shared tables or shared data between organizations.

  • Every row in every table contains an organization_id foreign key
  • Session validation enforces org membership on every request
  • API keys are org-scoped — no cross-org API access
  • File storage paths are tenant-prefixed — tenant_{org_id}/ prefix on all uploads
  • Audit logs are org-scoped — no audit trail leaks across tenants

DPDP Act 2023 Readiness

AUDT’s DPDP Privacy™ module is purpose-built for India’s Digital Personal Data Protection Act 2023.

Data inventory and classification
Consent records with audit trail
Data Subject Request (DSR) workflow
Retention policy management
Privacy Impact Assessments
Cross-border transfer documentation
Privacy Trust Score™ per data asset
DPO-ready reporting

Data Export & Deletion

You own your data. AUDT provides self-service data export and a formal deletion workflow.

  • Export Tenant Data — ZIP of all your data as CSVs, available via Settings ― Data Governance
  • Data deletion request — initiated via Settings ― Data Governance, processed within 30 days
  • API available — GET /api/export/tenant-data (session auth)
  • Audit log of all export and deletion events
  • On account termination, data is purged from all systems within 90 days

Retention & Backup

Data retention policies are configurable per organization and enforced by AUDT’s retention engine.

  • Default retention: 90 days for audit logs and governance events
  • Configurable retention policies per data category
  • Automated daily database backups — encrypted at rest
  • Point-in-time recovery available on Supabase
  • Backups stored in ap-south-1 — remain within India
← Back to Trust Center