Security & compliance commitments

Written for your security questionnaire.

Data protection

Tenant isolation is structural: every read and write is scoped to your organisation at the query layer and covered by an automated cross-tenant test matrix. Another organisation's key cannot see your data — probes return 404, revealing nothing.
Your API secret is stored only AES-256-GCM-encrypted; the raw value exists nowhere after issuance. Database encryption at rest; encrypted backups.
Borrower phone/email are masked in all logs; request and webhook bodies are never logged. API audit logs (metadata only) retain 90 days.
Webhooks contain only data about your own loans and borrowers.

Environment-locked keys (test rejected on production, and vice versa).
Signature-failure lockout + alerting; revocation effective ≤ 60s; zero-downtime rotation on request.
Optional hardening: IP allowlisting of your keys; our static egress IPs for your firewall.

We never hold or route borrower funds — collections land directly on your rails (how money flows). Cash is not accepted.
A payment event is only emitted for verifiably booked money.

Collections are performed under RBI fair-practices guidelines: trained and verified partners, disclosure of the lender-of-record on receipts (your registered disclosure text), regulated visit hours and frequency.

Events are written transactionally with the case change; deliveries retry ~31 hours then remain replayable 30 days; the poll API is an independent second lane. See reliability.