Security is foundational to what we do. As a company building data privacy compliance software, we hold ourselves to a high standard in protecting your personal data and the integrity of our systems.
1. Infrastructure Security
Hosting
privacyledger.ai is hosted on Vercel, a globally distributed edge platform. Vercel is SOC 2 Type II certified and operates on infrastructure built on AWS. All traffic is served over HTTPS using TLS 1.2 or higher. HTTP requests are automatically redirected to HTTPS.
Database
Personal data collected through our website is stored in a Neon serverless PostgreSQL database hosted in the ap-southeast-1 (Singapore) AWS region. Neon is SOC 2 Type II certified. Database connections are encrypted in transit using TLS. Access is restricted by IP allowlist and requires strong credentials.
Content Management
Our website content (blog, case studies, resources) is managed via Sanity, a hosted headless CMS. Sanity does not store personal data submitted through our contact forms.
2. Data Protection
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+. We enforce HTTPS with HSTS (HTTP Strict Transport Security).
- Encryption at rest: Data stored in our database is encrypted at rest using AES-256, managed by Neon's infrastructure.
- Minimal data collection: We collect only the personal data necessary for the stated purpose. We do not collect payment card data — all commercial transactions are handled by our payment processor.
- Access controls: Access to production systems and customer data is restricted to authorised personnel on a need-to-know basis. All access is logged.
3. Application Security
- Input validation: All data submitted through our website forms is validated server-side using strict schema validation before being stored.
- Rate limiting: Our API endpoints are rate-limited to prevent abuse and denial-of-service attacks.
- Security headers: We apply HTTP security headers on all responses, including Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security.
- Dependency management: We monitor our software dependencies for known vulnerabilities and apply patches promptly.
4. Organisational Security
- We follow the principle of least privilege for all internal access
- Production credentials are never stored in code or version control
- We conduct regular reviews of our security posture
- Team members with access to personal data are bound by confidentiality obligations
5. Incident Response
In the event of a personal data breach, we follow a documented incident response process:
- Contain and assess the breach within 24 hours of discovery
- Notify affected Data Principals and the Data Protection Board of India as required under Section 8(6) of the DPDP Act 2023
- Conduct a root-cause analysis and implement preventive measures
- Document the incident in our breach register
6. Responsible Disclosure
We are committed to working with the security community to keep our platform safe. If you discover a potential security vulnerability in privacyledger.ai, please report it to us responsibly.
Please email: security@privacyledger.ai
When reporting, please include:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept (screenshots, request/response logs)
We ask that you:
- Give us reasonable time (minimum 30 days) to investigate and remediate before any public disclosure
- Avoid accessing, modifying, or deleting data that does not belong to you
- Not perform denial-of-service attacks or social engineering
We acknowledge all valid security reports within 3 business days. We do not currently operate a paid bug bounty programme, but we gratefully recognise responsible reporters in our security acknowledgements.
7. Scope
The following are in scope for responsible disclosure:
- privacyledger.ai and its subdomains
- Our public-facing API endpoints
The following are out of scope:
- Third-party services we use (Vercel, Neon, Sanity) — report these directly to the respective vendor
- Social engineering or phishing attacks targeting our team
- Denial-of-service attacks
8. Contact
For security matters: security@privacyledger.ai
For data protection / DPO: dpo@privacyledger.ai
General: hello@privacyledger.ai