Skip to main content

Security and trust

What we run, where it runs, and what has been checked.

Last reviewed: 18 October 2026

A regulated buyer asks the same questions of every vendor: where is the data, who can reach it, what happens when something breaks, and who has checked. This page answers them with statements, not assurances. Each statement names its source and the date a person last verified it. Where something has not been done, the page says so.

Database
India (Mumbai)
Offsite backups
India (Mumbai)
At rest
AES-256
In transit
TLS 1.2+
Consent records
HMAC-SHA256 signed
Restore drill
18 Sep 2026, passed

Where the data lives

The platform database and its backups are in India. The processors that receive personal data outside India are the ones the Data Processing Agreement and the privacy policy name, with the data each receives stated there.

  • The platform database is a self-hosted Supabase (PostgreSQL) instance on Oracle Cloud Infrastructure in the Asia Pacific (Mumbai) region, India. The region was verified against Oracle's published IP ranges on 8 September 2026.

    Source: DPA clause 5.2, sub-processor table Verified 8 September 2026

  • Encrypted offsite copies of the database are written daily to Amazon Web Services, Asia Pacific (Mumbai) region, India.

    Source: DPA clause 10.4; privacy policy, processors table Verified 11 September 2026

  • The application and the marketing site run on Cloudflare Workers. Cloudflare (United States) handles request routing, data in transit, request logs and inbound mail routing for consentos.in addresses. It does not store the platform database.

    Source: DPA clause 5.2, sub-processor table Verified 7 September 2026

  • Cloudflare lists ISO 27001, ISO 27701, PCI DSS and SOC 2 among its own certifications. They apply to Cloudflare's network and operations. None extends to ConsentOS, which holds no certification of its own (see Independent assessment).

    Source: Cloudflare Trust Hub, cloudflare.com/trust-hub, read 17 October 2026 Verified 17 October 2026

  • Two United States processors hold personal data as records: HubSpot (name, business email, phone, company name and inquiry content of account and lead contacts) and Resend (recipient name and email address, message content and sent-message logs). Better Stack receives operational log lines and monitor results, with no personal data by design. The destination mailbox host for consentos.in mail is named in the sub-processor register.

    Source: DPA clause 5.2; privacy policy, processors table Verified 7 September 2026

Encryption and keys

Data is encrypted in transit and at rest. Consent evidence is signed, not merely stored.

  • Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted with AES-256.

    Source: DPA clause 4(d)(a) Verified 7 September 2026

  • Offsite backups are encrypted with a key that CivicLayer holds in AWS Key Management Service in the Mumbai region, separate from the storage itself.

    Source: Privacy policy, processors table; CivicLayer operations log (internal) Verified 11 September 2026

  • Every consent grant, consent withdrawal and erasure-denial record is signed with HMAC-SHA256 under a per-organisation key. Any party holding that key can verify a record. The records are tamper-evident.

    Source: Product: consent ledger signing, exercised in the restore drill of 18 September 2026 Verified 18 September 2026

Access control

Tenant isolation is enforced in the database, not only in the application.

  • Every tenant's rows are separated by PostgreSQL row-level security. Access to customer personal data is restricted to authorised personnel and scoped per tenant.

    Source: DPA clause 4(d)(b) Verified 7 September 2026

  • The anonymous database role holds no write grant. The consent ledger accepts writes only through signed database functions, not direct inserts.

    Source: CivicLayer operations log (internal), current configuration Verified 25 September 2026

  • Machine access to the consent API uses organisation-scoped bearer keys minted inside the customer's own Settings page. A key can be revoked by the customer at any time.

    Source: Product: API keys panel Verified 26 August 2026

  • Roles and capabilities inside a tenant are mapped per user. Rights requests are assigned to named handlers.

    Source: Product: roles and capabilities, live since 20 September 2026 Verified 20 September 2026

Backups and recovery

Backups run every night. Restoration has been tested, and the test checked the signatures, not only the row counts.

  • A full database dump is taken nightly and retained on the database host for 14 days.

    Source: DPA clauses 4(d)(d) and 10.4 Verified 11 September 2026

  • An encrypted copy is written to AWS Mumbai nightly. Each copy carries a 30-day deletion lock and expires after 35 days, so a deleted record persists in backups for at most 35 days.

    Source: DPA clause 10.4; DPA change log, version 1.2 Verified 11 September 2026

  • The first restore drill ran on 18 September 2026 from the offsite copy into an isolated database. Row counts and checksums matched production at backup time, all nine signed consent records verified, and a replay of consent withdrawals produced no discrepancy.

    Source: CivicLayer operations log (internal), restore drill of 18 September 2026 Verified 18 September 2026

  • The Data Processing Agreement commits CivicLayer to test restoration from backup at least once a year and to record the result.

    Source: DPA clause 4(d)(d) Verified 7 September 2026

Application and edge security

Browser-side defences are enforced by headers, and abuse of the public endpoints is rate-limited at the edge.

  • app.consentos.in serves a Content Security Policy with a per-request nonce and strict-dynamic, deployed 2 August 2026.

    Source: CivicLayer operations log (internal); verifiable from the response headers of app.consentos.in Verified 2 August 2026

  • consentos.in sends HTTP Strict Transport Security with preload, X-Frame-Options DENY, a restrictive Permissions-Policy and a Content Security Policy that forbids framing.

    Source: website/public/_headers Verified 9 October 2026

  • The public endpoints on consentos.in that accept personal data are rate-limited at the Cloudflare edge. The authenticated application enforces its own durable rate limits in code.

    Source: CivicLayer operations log (internal) Verified 4 September 2026

  • consentos.in sets no cookies of its own and runs no analytics script. Traffic figures come from edge analytics.

    Source: Privacy policy, cookies section Verified 21 September 2026

Monitoring and logging

Availability is watched from outside. Logs are kept free of personal data by design.

  • External uptime monitors check the website and the application on a fixed interval and alert the operator.

    Source: DPA clause 5.2 (uptime monitoring entry); CivicLayer operations log (internal) Verified 10 September 2026

  • A scheduled synthetic check exercises a production path and reports a heartbeat, so a silent failure is detected without waiting for a customer report.

    Source: CivicLayer operations log (internal) Verified 23 September 2026

  • Application logs are kept free of personal data by design. API error responses carry no personal data by rule.

    Source: DPA clause 5.2 (log sink entry); CivicLayer engineering rules (internal) Verified 7 September 2026

  • There is no public status page yet.

    Source: CivicLayer operations log (internal) Verified 9 October 2026

Incident response and disclosure

A personal data breach is reported on the clocks the law sets, before those clocks bind. Security reports from outside are read by the founder.

  • Rule 7 of the DPDP Rules 2025 becomes enforceable on 13 May 2027, and CivicLayer operates to it now: on any personal data breach, affected individuals are intimated without delay and the Data Protection Board of India is intimated in the manner and within the timelines Rule 7 prescribes, including the detailed report within 72 hours of becoming aware. No severity threshold applies.

    Source: Privacy policy, security incidents section Verified 21 September 2026

  • Cyber incidents in scope of the CERT-In Directions are reported within six hours. That duty is in force today, independent of the DPDP timeline.

    Source: Privacy policy; verified legal facts Verified 21 September 2026

  • Security reports go to security@consentos.in. The mailbox is read by the founder. There is no bug bounty programme.

    Source: CivicLayer operations log (internal), mail routing verified Verified 23 September 2026

Independent assessment

What has been checked by someone other than us, and what has not.

  • No vulnerability assessment or penetration test by an independent firm has been performed as of 9 October 2026.

    Source: CivicLayer operations log (internal) Verified 9 October 2026

  • An external, AI-assisted security review of the application was conducted in August 2026. Its findings have been addressed.

    Source: CivicLayer operations log (internal) Verified 4 September 2026

  • ConsentOS holds no ISO 27001 certification and no SOC 2 report.

    Source: CivicLayer operations log (internal) Verified 9 October 2026

  • The Data Processing Agreement is supplied during procurement. Version 1.0 was reviewed by counsel on 7 September 2026; the current version is under counsel review.

    Source: DPA header Verified 9 October 2026

Processors and agreements

The full list of processors, their locations and the data each receives is published in the privacy policy. The Data Processing Agreement is supplied during procurement. Report a security issue to security@consentos.in; the machine-readable contact is at /.well-known/security.txt.

A statement on this page describes the system as verified on the date shown. It is not a warranty. A source marked internal is CivicLayer's own record; it is produced during procurement on request. Contractual commitments are those in the Data Processing Agreement and the Terms of Service.