Security
Your client's data stays in India.
Audit data is among the most sensitive a business holds, and you are accountable to your client for where it goes. This page is written to be forwarded to them.
Read this first
What we have not certified.
Most vendors open a security page with a row of badges. We will publish ours when the audits are complete and the reports can be produced on request — and not a day before. Until then, this page describes the controls we actually operate, stated plainly rather than dressed up as certifications we do not hold.
Application security
- Database access is server-side only — credentials never reach the browser
- Secrets are managed through environment configuration, kept out of source control
- Every input is validated again on the server, independent of client-side checks
- API routes reject malformed requests and rate-limit repeated submissions
Data handling
- Data minimisation by design — only what a workflow needs is collected
- Tenant isolation is architected for, and enforced before any real client data is accepted
- Encrypted in transit end to end
- Encryption at rest through the infrastructure providers Lekhya runs on
Operational controls
- Access to the codebase and infrastructure is limited to the people building it
- Actions that change data are logged server-side, not only in the browser
- An incident response procedure is defined ahead of holding real client data
- Backup and recovery sits with the managed database provider today
Formal third-party certifications are not currently claimed.
SOC 2 Type II, ISO 27001 and ISO 42001 are each not yet obtained.
If a certification matters to your client’s policy today, tell us on the call. We would rather lose the engagement than imply an assurance we do not have.
Controls we operate
Where data lives and who can reach it.
Data residency
All client data is stored and processed in Indian regions. Backups remain in India. No engagement data is replicated to a region outside the country.
Encryption
Encrypted in transit with TLS, and at rest with AES-256. Document storage and database storage are encrypted independently.
Access control
Staff see only engagements they are assigned to. Roles map to the audit hierarchy — preparer, reviewer, partner — and an evidence link never grants access a user does not already hold.
Audit logging
Every action is recorded with the user, the timestamp and the value it replaced. The log is exportable with the engagement file and cannot be edited from within the application.
Retention and deletion
Engagement data is retained for the period you specify, consistent with your firm's own retention policy. On termination, data is exported in full and then deleted on a defined schedule.
Tenant separation
Each firm's data is logically separated. One firm's engagements are never queryable from another's session, and support access requires explicit, logged, time-bound authorisation.
AI and your data
Your engagements do not train anything.
This is the question every partner asks second, immediately after asking where the data is stored. The answer needs to be specific rather than reassuring, so here is exactly what the commitment covers.
What we commit to
- Client data is never used to train our models
- Client data is never used to train a third-party provider's models
- Model providers are contractually bound to zero data retention
- Every model provider we use is named in the subprocessor list
What the commitment does not cover
- Aggregate, non-identifying usage metrics — how often a procedure runs, how long it takes
- Corrections you make to a finding, used to improve rules within your own firm's tenant only
- Support access you explicitly authorise, which is time-bound and logged
Subprocessors
Current prototype infrastructure.
This is what the product you can try today actually runs on — not a placeholder list, and not the final production inventory. A production subprocessor list, with region and purpose for each and advance notice of any change, will be published before real client data is processed.
Application hosting
The web application is deployed and served from Vercel's platform.
Database
The one real database behind this prototype — demo requests and enquiries, nothing from an audit file — is a managed Postgres instance on Neon.
Email or notification services
None are connected. No automated email, SMS or notification is sent by the product today.
Indian data protection
DPDP Act position
Under the Digital Personal Data Protection Act, your firm is the Data Fiduciary for the personal data contained in engagement files, and Lekhya acts as a Data Processor on your instructions. Our data processing agreement reflects that allocation, covers purpose limitation and breach notification, and is available for your review before any data is uploaded.
This is a description of our contractual position, not legal advice. Your firm should form its own view.
Send us your security questionnaire.
If your firm or your client has a standard questionnaire, send it before the call and we will return it completed — including the questions where the answer is “not yet.”