Security Architecture & Trust Whitepaper

CompTrust is engineered from the ground up to satisfy the strictest data sovereignty, localization, and fiduciary duties mandated by the Digital Personal Data Protection Act, 2023.

• Primary Cloud Provider: Amazon Web Services (AWS), situated exclusively in the Asia Pacific (Mumbai) `ap-south-1` region.
• Data Localization Guarantee: All customer production databases, archival logs, consent telemetry, and cryptographic certificates remain within Indian territorial borders. We never replicate or transfer customer personal data across international borders.
• Physical Security: AWS data centers feature 24/7 armed security, biometric access controls, video surveillance, and dual redundant power and cooling infrastructures meeting ISO 27001, SOC 1/2/3, and PCI-DSS Level 1 compliance.

Under DPDP Section 8(5), Data Fiduciaries and Processors must implement reasonable security safeguards. CompTrust incorporates military-grade cryptographic protection:

CompTrust employs a shared-database, isolated-schema multi-tenant model with strict row-level application security:

• Organizational Boundary Scoping: Every database query in the API runtime incorporates an immutable filter on `organizationId`. A tenant can never execute a query against, or read records belonging to, another organization.
• Continuous Tenant Bleed Testing: Our CI/CD pipeline runs automated regression tests verifying that cross-tenant access attempts receive immediate `404 Not Found` or `401 Unauthorized` responses.
• Isolated Object Storage: Uploaded vendor agreements, DPIA sign-offs, and compliance reports are segregated into tenant-specific S3 directories (`uploads/dpas/[orgId]/...`).

• Enterprise Identity: Authentication is powered by Clerk enterprise identity management, providing hardware security token support (FIDO2 / WebAuthn), biometric passkeys, and SMS/TOTP Multi-Factor Authentication (MFA).
• Short-Lived JWT Tokens: Session tokens expire after 15 minutes and rotate continuously, minimizing the blast radius of session interception.
• Role-Based Access Control (RBAC): Four distinct privilege tiers are enforced:
  • Owner: Organization administration, billing, and permanent account actions.
  • Admin: Configuration of webhooks, consent SDKs, retention policies, and team invites.
  • Member: Operational handling of DSR requests, DPIA evaluations, and breach triaging.
  • Viewer: Read-only inspection of reports and audit logs for external legal auditors.

• High Availability Deployment: Compute services run on multi-zone load-balanced instances with health-check-driven auto-restart and zero-downtime rolling deployments.
• Continuous Database Archival: PostgreSQL transaction logs (WAL) are streamed continuously, providing point-in-time recovery (PITR) up to 30 days. Daily encrypted snapshot backups are retained for 90 days.
• Target RPO: Less than one (1) hour.
• Target RTO: Less than four (4) hours in the event of a catastrophic regional datacenter incident.

CompTrust operates a continuous vulnerability management program:

• Automated static code analysis (SAST) and software dependency scanning (Dependabot / Snyk) run on every git commit.
• Third-party penetration testing is commissioned annually by independent CERT-In empanelled security audit firms.
• Responsible Disclosure Policy: Security researchers can report potential vulnerabilities to security@comptrust.app. We commit to acknowledging reports within twenty-four (24) hours and providing regular remediation status updates.