Legal
Security
Last updated
A summary of how the platform is secured and where data lives. Written for the procurement and security teams who have to assess us.
Data residency
Application and database workloads run in the India (Mumbai region). Personal data is not transferred out of India in the normal course of operating the service.
Encryption
In transit: TLS 1.3, HSTS, and a strict Content Security Policy. At rest: full-disk encryption on the database host, with encrypted off-site backups.
Access control
Role-based access, deny-by-default, scoped per organisation. Administrative and owner roles require a second factor. Every privileged action is written to an immutable audit log.
Sub-processors
Kept deliberately short. Each is listed with what it processes and why.
- Hostinger — infrastructure hosting, Mumbai region.
- Cloudflare — CDN, WAF, DDoS protection and bot mitigation.
- Cloudflare R2 — object storage for rendered media and uploads.
- Fincept — market data API. Receives query parameters only, never personal data.
Resilience
Nightly encrypted database backups to off-site storage with 30-day retention, and a restore drill performed quarterly. A backup that has never been restored is not a backup.
Development practice
Every change passes automated linting, type checking, tests, an accessibility gate, a performance budget, dependency audit and static analysis before it can merge. Dependencies are updated automatically and container images are scanned.
Reporting a vulnerability
Email security@adnexatech.in. We aim to acknowledge within 3 working days and will keep you updated until the issue is resolved. We will not pursue legal action against good-faith research that respects user privacy and avoids service degradation. Our machine-readable policy is published at /.well-known/security.txt.