CompTrust Trust Center
Transparent, verifiable, and audit-grade privacy engineering for India’s Digital Personal Data Protection Act 2023 and EU GDPR. Review our security architecture, legal agreements, uptime SLA, and public verification tools.
AWS Mumbai
100% Sovereign Cloud
AES-256 KMS
At-Rest & TLS 1.3
99.9% Uptime
Contractual SLA
< 2h Response
P1 Incident Support
SHA-256 Proof
Public Erasure Seal
Zero Lock-in
1-Click JSON Export
Enterprise Legal & Technical Package
Institutional documentation for General Counsels, DPOs, and Information Security teams.
Customer Data Processing Agreement
Statutory DPA under DPDP Act Section 8 and GDPR Article 28. Defines Customer as Data Fiduciary and CompTrust as Data Processor with binding TOMs, 30-day subprocessor notice, and 24h breach assistance.
Security Architecture Whitepaper
In-depth architectural review covering AWS Mumbai sovereign hosting, envelope AES-256 KMS encryption, logical tenant isolation, target RPO < 1h, RTO < 4h, and vulnerability disclosure.
Authorized Subprocessor Directory
Public register of all downstream infrastructure processors (AWS Mumbai, Clerk, Razorpay, Sentry, Render, Netlify) with transfer mechanisms, certifications, and CISO notification subscriptions.
Service Level Agreement (SLA)
Contractual 99.9% uptime availability commitment backed by financial service credits (10% to 50%), 24/7/365 critical escalation, and degraded fail-safe architecture.
Public Certificate of Erasure Verifier
Unauthenticated public tool enabling third-party auditors and regulators to verify SHA-256 cryptographic proofs of personal data erasure under DPDP Act Section 8(7).
30-Point Due-Diligence Evaluation
Systematic line-by-line responses to all 30 procurement audit questions covering technical operations, encryption, DSR workflows, and legal protections.
Technical & Organizational Safeguards (TOMs)
Contractually incorporated safeguards under DPDP Act 2023 Section 8(5) and GDPR Article 32.
All customer personal data is hosted strictly within AWS Mumbai (ap-south-1) on Indian soil. Zero unauthorized offshore transfers.
AES-256 data-at-rest encryption via AWS KMS HSMs. TLS 1.3 in transit with strict HSTS (max-age 63072000) and Perfect Forward Secrecy.
Strict logical separation with mandatory organizationId scoping on all queries. Automated integration regression tests enforce cross-tenant isolation.
Retention and erasure events generate canonical SHA-256 Certificate of Erasure hashes, verifiable independently on our public verifier portal.
Automated breach incident management with CERT-In and DPBI regulatory triage, live countdown timers, and affected victim notification templates.
1-Click Master Compliance Export provides an unencumbered, machine-readable JSON package with a whole-archive SHA-256 integrity checksum.
Frequently Asked Procurement & Audit Questions
Direct answers to common institutional security assessments.
Where is customer personal data stored?
All production databases, audit logs, and compliance records are hosted exclusively in AWS Mumbai (ap-south-1), fulfilling Indian data sovereignty standards under the DPDP Act 2023.
Can our security team independently verify erasure?
Yes. Every executed retention policy produces an untamperable SHA-256 Certificate of Erasure hash. Anyone with the certificate ID or hash can verify its authenticity at /verify-certificate without authentication.
What happens to our compliance data upon termination?
Under Section 10 of our Customer DPA, customers have 30 days post-termination to export all compliance data via 1-Click Master Export. After 30 days, CompTrust irreversibly purges the tenant database and delivers a final Certificate of Erasure.
Are webhooks protected against spoofing and replay attacks?
Yes. All outbound webhook events include an X-CompTrust-Signature header generated via HMAC-SHA256 with timestamp replay window enforcement (maximum 300 seconds). Customers can replay and test events directly in the console.
Ready for Audit-Grade DPDP Compliance?
Protect your organization from Section 33 penalties of up to ₹250 Crore with CompTrust’s sovereign compliance engine, cryptographic proof seals, and automated DSR workflows.