Autometa / Security and trust
How we protect your data.
An accurate account of the controls we operate today, not the ones we intend to add.
- Encrypted in transitTLS enforced on every endpoint
- Tenant isolationEvery table partitioned by organisation
- No AI trainingYour data never trains a model
- Data hosted in IndiaPrimary infrastructure in ap-south-1
Six layers of defence.
How we safeguard your customer data, communication channels and business records at every tier.
Encryption
Customer data is encrypted in transit with enforced TLS and HTTP Strict Transport Security across all public endpoints and APIs. Passwords are stored as bcrypt hashes. Integration credentials, OAuth tokens, API secrets and two-factor secrets are encrypted with AES-256-GCM at the application layer before they ever reach the database, and are never stored in plaintext.
Infrastructure
The application, database and cache run on dedicated infrastructure we operate, with all service ports bound to loopback and TLS terminated at a hardened reverse proxy. Object storage, call recordings and exports are held in Amazon S3 in the Mumbai (ap-south-1) region, delivered through CloudFront. Container images are built and deployed through an automated pipeline; secrets are injected at runtime and never committed.
Access Governance
Role-based access control with granular per-object and per-field permissions, optional enforced two-factor authentication, optional IP allow-listing per organisation, full session enumeration with device and IP visibility, one-click revocation of every active session, and an audit log recording every administrative action against a workspace.
Multi-Tenant Isolation
Every domain table carries an organisation identifier, and every API path filters on the authenticated caller’s organisation before any other predicate. Access tokens carry a revocation epoch, so disabling a user or changing a password invalidates every outstanding token immediately rather than waiting for expiry.
AI Data Handling
We do not use customer data to train, fine-tune or improve any AI model, ours or anyone else’s. AI requests are scoped to the requesting workspace and to the permissions of the user making them. We hold zero-data-retention terms with [[PROVIDERS WITH SIGNED ZDR TERMS]]; other model providers are engaged under their standard commercial API terms, which typically permit short-term retention for abuse monitoring. Every provider is named on our sub-processors page.
Monitoring & Disclosure
Application errors and performance are monitored continuously, with personally identifiable information suppressed in backend reports and text masked in frontend session replays. Authentication endpoints are rate-limited and protected by bot challenges. We operate a responsible disclosure process with safe harbour for good-faith researchers.
Where we stand, stated plainly.
We would rather tell you exactly what we have than imply something we do not.
| Area | Position |
|---|---|
| Data protection law | We operate under India’s Digital Personal Data Protection Act, 2023, with a named Grievance Officer. For customers subject to the GDPR or UK GDPR we offer a Data Processing Addendum containing Article 28 processor commitments. |
| Independent audit | [[SOC 2 TYPE II: state the auditor and the audit period, and that a report is available under NDA. If no completed report exists, replace this row with: “We have not yet completed an independent security audit. We respond to customer security questionnaires on request.”]] |
| Penetration testing | [[STATE WHETHER A THIRD-PARTY PENETRATION TEST HAS BEEN PERFORMED, AND WHEN. Remove this row if none has.]] |
| Payment security | Card data is captured and processed entirely by Razorpay, a PCI-DSS compliant payment gateway. We never receive or store full card numbers. |
| Uptime | We use commercially reasonable efforts to maintain availability. We do not currently offer a contractual uptime guarantee or service credits. |
| Data residency | Primary infrastructure and object storage are in India. Certain sub-processors, notably AI, error-monitoring and email providers, process data outside India. All are named on our sub-processors page. |
| Retention | We do not currently apply automatic time-based expiry to call recordings, transcripts, messages, emails or files. Data persists until you delete it or your workspace is deleted. |
The complete list of third parties that process data on our behalf is on our sub-processors page. Our processor commitments are in the Data Processing Addendum, and our full data practices in the privacy policy.
Responsible disclosure and security research
We welcome reports from security researchers. If you believe you have found a vulnerability in Autometa CRM or our API infrastructure, report it to our security address and give us reasonable time to fix it before disclosing publicly. We do not currently run a paid bug bounty programme.
- Reporting channel
- security@autometa.in
- Initial response
- Within 24 business hours
- Safe harbour
- No action against good-faith researchers
Need a DPA or a security questionnaire completed?
We respond to vendor security reviews and can provide our Data Processing Addendum on request.