What protects your data now
DPDP Act 2023 and data minimisation
Scanning never writes email bodies to our database, only the fraud verdict and detection metadata; an email you choose to report is kept inside its cybercrime evidence pack for up to 12 months (24 if extended for an ongoing case). Audio is processed in memory and deleted within minutes of analysis. Phone numbers are stored as a keyed hash, never in plain text. A deletion request is completed within 30 days, except the records our privacy policy lists, and we notify affected customers and, where required, the Data Protection Board of India in the event of a breach. Full detail in the privacy policy.
Data residency: Azure Central India
Our servers and database run on Microsoft Azure Central India. Some of our service providers process data outside India, for example masked message content sent to Anthropic for Component D scanning and transactional emails delivered through Resend. Every sub-processor, including AI model providers, is listed in the privacy policy with what it receives, where and when.
Encryption
All traffic is HTTPS only, with HTTP redirected and HSTS enforced for one year with preload. Storage sits on Azure Central India infrastructure with Azure’s server-side encryption at rest. On top of that, the most sensitive secrets are encrypted at the application layer: authenticator (TOTP) secrets and third-party API credentials with Fernet (AES-128-CBC with HMAC-SHA256), never held in plain text; passwords and recovery codes are stored only as salted hashes.
Authentication and access control
Authenticator-app (TOTP) multi-factor authentication, mandatory for staff and for every new customer and invited team member, with one-time recovery codes. Sessions use short-lived RS256-signed tokens with server-side revocation. Repeated failed logins lock the account-and-address pair for an hour after five attempts. Every customer’s data is isolated per company; CA firms get a separate tenant per client.
Application hardening
Every response carries a Content-Security-Policy, X-Content-Type-Options: nosniff, a strict Referrer-Policy and a Permissions-Policy that disables camera, microphone and geolocation. Inbound webhooks from Meta (WhatsApp) and Razorpay are signature-verified before they are processed. An internal OWASP Top 10 review was run before the Azure deployment and its findings remediated, and dependency vulnerability alerts (Dependabot) are enabled on the codebase.
A named person, not a queue
Data Protection Officer and Grievance Officer: Darshil Thummar, Co-Founder & CTO. Privacy and data requests: privacy@scamshieldai.in, 72-hour response. Security issues: security@scamshieldai.in, never a public issue tracker. Written commitments: Privacy policy · Terms · SLA (99.5% monthly availability target).
Found a vulnerability? Tell us directly.
Email security@scamshieldai.in. We acknowledge every report within 72 hours and will tell you what we found and when it is fixed. Include what you tested, how to reproduce it, and what you think the impact is. Please do not access, change or keep any customer data beyond what is needed to demonstrate the issue, and give us reasonable time to fix it before publishing. Machine-readable details: /.well-known/security.txt.