What this site holds
No end-customer identity data, ever. This site does not collect, process, transmit or store identity documents, Aadhaar numbers, PAN numbers or biometric data. There is no upload capability and no demo that accepts real data. The only personal data involved is the business contact detail someone chooses to send us when starting a conversation.
In client engagements the same boundary holds: verification calls flow between the client's systems and the client's chosen providers. We build and operate the code that makes those calls and stay out of the data path.
Architecture
The site is static-first. Pages are prerendered at build time and served as files, so the request path for a page view involves no server-side rendering, no database query and no user session. There are no user accounts and no authentication surface on this site, which removes an entire class of vulnerability rather than mitigating it.
Data residency
Application and database infrastructure runs in AWS ap-south-1, in India. Enquiry data is held in our own database as the source of truth rather than in a third-party form product.
Secrets
Credentials are held in AWS Secrets Manager and injected at runtime. No secret is present in the frontend bundle, in the repository, or in any client-side environment variable. Every commit is scanned for credentials before it lands, and the same scan runs across full history in CI, so bypassing the local hook does not bypass the check.
Transport and headers
HTTPS only, with HSTS. Responses carryX-Content-Type-Options: nosniff, a restrictive Referrer-Policy, aPermissions-Policy denying camera, microphone and geolocation, and a Content-Security-Policy restricting script and connection origins.
Third parties
No tag manager is used. Analytics load only after explicit consent, and no third-party request is issued before that consent is given. The current sub-processor list is published on the privacy page.
Engineering controls
Changes reach production through review and an automated pipeline. Accessibility, performance and content-quality gates run on every change and block a merge when they fail. Dependencies are pinned and updated deliberately.