Your data is non-negotiable.
Autroid is built with enterprise-grade security from the ground up — encryption, compliance, access controls, and India-first data residency. Not bolted on. Foundational.
Defense in Depth
Five layers between an attacker and your data.
Security is not a single wall — it is layers, each independent, each protecting the one beneath it. A breach of any one layer still leaves the rest standing.
Edge
TLS 1.2+ everywhere, HTTPS-only. Traffic is encrypted the moment it leaves the browser.
TLS 1.2+HTTPS-onlyHSTSNetwork
AWS Mumbai VPC with private subnets and IAM-controlled, least-privilege access to every resource.
VPC isolationPrivate subnetsIAM least-privilegeAccess
Module-level RBAC with four permission tiers, MFA support, and secure session-token rotation.
Module RBACMFASession rotationData
AES-256 encryption at rest via AWS KMS, encrypted daily backups, and strict per-tenant isolation.
AES-256 at restKMSTenant isolationAudit
An immutable audit trail on every action plus 24/7 anomaly monitoring — nothing happens unrecorded.
Immutable trail24/7 monitoring
Security Posture
Six pillars of enterprise security.
Every layer of Autroid — from infrastructure to application — is designed with defense-in-depth principles. No shortcuts. No exceptions.
Data Encryption
Every byte of your data is encrypted — at rest and in transit — with no exceptions.
- AES-256 encryption at rest for all stored data
- TLS 1.2+ for all data in transit (HTTPS-only)
- OAuth tokens encrypted via AWS Secrets Manager
- Database-level encryption with AWS KMS
Infrastructure Security
Hosted on AWS with multi-layered network isolation and automated threat detection.
- AWS Mumbai (ap-south-1) primary region
- VPC network isolation with private subnets
- Automated daily encrypted backups
- IAM-controlled access with least-privilege
Access Controls
Granular, role-based permissions enforced at every API endpoint and UI element.
- Module-level RBAC with 4 permission tiers
- Multi-factor authentication (MFA) support
- Complete audit trail for every user action
- Session management with secure token rotation
Compliance
Built to meet the compliance requirements of Indian and international regulations.
- SOC 2 Type II readiness framework
- DPDP Act (India) compliant architecture
- GDPR-aware data processing practices
- GST regulatory compliance built-in
Incident Response
Structured response protocol with clear escalation paths and notification timelines.
- 24/7 automated anomaly monitoring
- Defined escalation within 30 minutes
- User notification within 72 hours of breach
- Post-incident review and remediation
Security Assessments
Regular internal audits, penetration tests, and vulnerability scans across the platform.
- Quarterly vulnerability assessments
- Annual third-party penetration testing
- Continuous dependency scanning (CVE)
- Code review gates in CI/CD pipeline
Tamper Evidence
Try to alter the books. Watch them tell on you.
Every journal entry in Autroid is sealed with a SHA-256 hash that includes the previous entry's seal — a chain. Change any entry and every seal after it breaks, permanently and visibly. This is a live demonstration of the mechanism: click an entry to tamper with it.
Compliance
Built for regulatory readiness.
SOC 2 Type II
Organizational controls for security, availability, and confidentiality.
DPDP Act
India's Digital Personal Data Protection Act — compliant architecture.
GDPR-Aware
Data processing practices aligned with EU General Data Protection Regulation.
PCI-DSS
Payment processing through PCI-DSS certified third-party partners.
Infrastructure
Enterprise infrastructure. India-first.
Hosted on Amazon Web Services with multi-layered security, automated backups, and strict network isolation. Your data never leaves India.
Data residency in India with low-latency access for Indian businesses.
Military-grade encryption for data at rest and in transit.
Point-in-time recovery with encrypted backups retained for 30 days.
Multi-layered network security with no public-facing database endpoints.
Centralized, encrypted credential storage with automatic rotation.
Least-privilege IAM policies combined with application-level RBAC.
Incident Response
Structured response. Clear escalation.
When something goes wrong, every second counts. Our four-phase incident response protocol ensures rapid containment and transparent communication.
Detect
Automated monitoring flags anomalies in real time across all system layers.
Contain
Immediate isolation of affected systems within 30 minutes of detection.
Notify
Affected users and regulators notified within 72 hours as required by law.
Remediate
Root cause analysis, fix deployment, and post-incident review completed.
Data Residency
India-first. Mumbai region.
All customer data is stored exclusively in the AWS Mumbai (ap-south-1) region.Autroid is designed for Indian businesses with Indian compliance requirements — your data stays in India, governed by Indian law.
Questions about security?
Our team is ready to walk you through our security architecture, compliance posture, and data handling practices in detail.