Security

Confirmita is a DPDP compliance platform, so we hold ourselves to the same standard we help our customers meet. Security isn't a separate initiative bolted on afterward; it's built into how we handle data from the ground up.

This page describes what's actually true about our security practices today. We'd rather tell you plainly what we have and what's still on our roadmap than imply a level of maturity we haven't reached yet.

confirmita.com and the Confirmita platform are operated by:

Our infrastructure runs on AWS and Vercel. Our primary database and the application logic that serves confirmita.com both run from the Mumbai (ap-south-1) region. We use S3-compatible object storage for uploaded files and evidence records.

Access to customer data is scoped by organisation: one customer's environment cannot see another's.

• Data in transit is encrypted (TLS).
• Personal data that directly identifies you, such as your name, email address, and phone number, is encrypted at rest.
• Passwords are never stored in plain text; we use salted cryptographic hashing (Argon2).

Sessions are secured with httpOnly, secure cookies. Customer accounts are provisioned by Confirmita or by an organisation's own administrator, not through open public self-signup, and access within the product is scoped to the organisation and role a user belongs to.

If you believe you've found a security issue in confirmita.com or the Confirmita platform, email [email protected] with enough detail to reproduce it. We'll acknowledge your report and keep you updated as we investigate.

Please report issues privately and give us a reasonable opportunity to address them before any public disclosure. We don't currently run a paid bug bounty program, but we take every genuine report seriously.

We're a growing platform. Formal third-party certifications, such as SOC 2 or ISO 27001, and a regular third-party penetration-testing program are on our roadmap as we scale, not something we hold today. We'll update this page as that changes.