What protects your data now
DPDP Act 2023 and data minimisation
Email bodies are never written to our database, only the fraud verdict and detection metadata. Audio is processed in memory and deleted within minutes of analysis. Phone numbers are stored as a keyed hash, never in plain text. A deletion request is completed within 30 days, and we notify affected customers and, where required, the Data Protection Board of India in the event of a breach. Full detail in the privacy policy.
Data residency: Azure Central India
All processing and storage runs on Microsoft Azure Central India. No threat data, email content or business information is transmitted to an overseas server, in line with RBI data-residency guidance and the DPDP Act 2023. Sub-processors, including AI model providers, are listed in the privacy policy.
Encryption
All traffic is HTTPS only, with HTTP redirected and HSTS enforced for one year with preload. Storage sits on Azure Central India infrastructure with Azure’s server-side encryption at rest. On top of that, the most sensitive secrets are encrypted at the application layer: authenticator (TOTP) secrets and third-party API credentials with Fernet (AES-128-CBC with HMAC-SHA256), never held in plain text; passwords and recovery codes are stored only as salted hashes.
Authentication and access control
Authenticator-app (TOTP) multi-factor authentication, mandatory for staff and for every new customer and invited team member, with one-time recovery codes. Sessions use short-lived RS256-signed tokens with server-side revocation. Repeated failed logins lock the account-and-address pair for an hour after five attempts. Every customer’s data is isolated per company; CA firms get a separate tenant per client.
Application hardening
Every response carries a Content-Security-Policy, X-Content-Type-Options: nosniff, a strict Referrer-Policy and a Permissions-Policy that disables camera, microphone and geolocation. Inbound webhooks from Meta (WhatsApp) and Razorpay are signature-verified before they are processed. An internal OWASP Top 10 review was run before the Azure deployment and its findings remediated, and dependency vulnerability alerts (Dependabot) are enabled on the codebase.
A named person, not a queue
Data Protection Officer and Grievance Officer: Darshil Thummar, Co-Founder & CTO. Privacy and data requests: privacy@scamshieldai.in, 72-hour response. Security issues: security@scamshieldai.in, never a public issue tracker. Written commitments: Privacy policy · Terms · SLA (99.5% monthly availability target).
Found a vulnerability? Tell us directly.
Email security@scamshieldai.in. We acknowledge every report within 72 hours and will tell you what we found and when it is fixed. Include what you tested, how to reproduce it, and what you think the impact is. Please do not access, change or keep any customer data beyond what is needed to demonstrate the issue, and give us reasonable time to fix it before publishing. Machine-readable details: /.well-known/security.txt.