Trust
Security and data handling
This product handles compliance evidence, so it is fair to ask exactly what we hold and what we do not. Here it is, without the usual hedging.
What we store, and what we do not
| Your account | Name, email, organisation, user identifier — held by Clerk |
| Engagement records | Auditee names, scope, control answers, findings, remediation |
| Evidence artefacts | The files you attach, plus a SHA-256 hash of each |
| Report registry | Report id, signature, hashes and status — not the report body, and not your evidence |
| Audit trail | An append-only log of every action, committed to by Merkle root |
| Technical logs | Request logs, kept 90 days |
The registry deliberately holds hashes rather than documents, so a report can be proved genuine without us retaining a copy of it.
How it is protected
- Transport is encrypted throughout; plain HTTP is redirected and HSTS is enforced.
- Each firm's data is isolated by tenant on every query — one practice cannot see another's engagements.
- Every document is hashed on receipt, so alteration is detectable after the fact.
- Reports are signed with PAdES; any edit to a certified PDF breaks its signature.
- The engagement trail is append-only and sealed under a Merkle root the report commits to.
- Access to production systems is restricted and password-based keys are not shared.
Who processes data on our behalf
| Service | Cyber Vigilance Group, operating DPDP Done |
| Hosting | A single VPS in Mumbai, India (Hostinger), with TLS terminated in front of the application |
| Authentication | Clerk — sign-in and organisation management |
| Resend — acknowledgement and notification mail | |
| Payments | Razorpay, when billing goes live. Card details never reach our servers |
| Backups | Nightly, retained 30 days, integrity-checked, with a documented restore drill |
If something goes wrong
On becoming aware of a personal data breach we notify the Data Protection Board of India and each affected person, describing the nature and extent of the breach, the consequences likely to arise, and the mitigation we have taken. Our own notice sets out how to reach us and how to escalate to the Board.
What we do not hold — yet. DPDP Done does not currently have SOC 2 or ISO 27001 certification, and we will not imply otherwise. Backups are taken nightly and a restore is proven, but they live on the same infrastructure as the service; an offsite copy is planned. If your procurement requires certification, tell us at privacy@dpdpdone.com and we will tell you exactly where we stand.