Data security

Our approach

We design our products on the basis that the data belongs to our clients and their customers. We process it only to deliver the service our client has asked for.

Principles we follow

Purpose and consent

Customer data is processed only for the purpose the customer has consented to, such as verifying identity or assessing a loan application. Our clients are responsible for collecting that consent; our products are built to support it.

Collecting only what's needed

Each check uses the minimum data required, and data is not kept longer than the service and the law require.

Protection in transit and at rest

Data is encrypted when it moves between systems and protected where it is stored.

Restricted access

Access to client data is limited to people who need it to deliver or support the service, and is logged.

Trusted providers

Where a service depends on an authorised third party, such as an eSign service provider for Aadhaar eSign, we work only with providers authorised to deliver that service.

Incident response

If we become aware of a security incident affecting client data, we act to contain it and inform affected clients without undue delay, so they can meet their own obligations.

Regulatory context

We build our products to help clients meet their obligations under the Digital Personal Data Protection Act, 2023 and the regulations that apply to their sector. Detailed security terms are set out in our agreements with each client.

Questions

If you are evaluating Esfita and need our security documentation, please get in touch.