Certifications
ISO 27001 — in progress
Stage-1 audit complete. Stage-2 scheduled. We publish the certificate the day it is issued.
Where we are today
Posture, not promises.
Residency
India data residency
Customer data lives in Mumbai by default. Sub-processors documented in the DPA — no surprises.
Encryption
At rest and in transit
AES-256 at rest, TLS 1.3 in transit, key rotation on a schedule customers can audit.
Authentication
SSO and SCIM
SAML and OIDC SSO with Okta, Azure AD and Google. SCIM provisioning included on Enterprise.
Authorisation
Scoped tokens
OAuth2 client credentials with fine-grained scopes. Least-privilege by default.
Events
Signed event streams
Outbound webhooks signed with a rotating key. Replay protection enforced.
Logging
Immutable audit log
Cryptographic receipts on every consent and access event. Exportable to the Data Protection Board.
Scanners
In-VPC discovery
truScanner and truFinder run inside your VPC. Personal data never leaves your network.
Disclosure
Coordinated disclosure
A published vulnerability disclosure policy at security@truconsent.io. We acknowledge within 24 hours.
What we hand to procurement
A short list, not a binder.
- Latest ISO 27001 audit letter
- Sub-processor list with location and purpose
- Penetration test summary (annual)
- Data Processor Addendum (DPDP-aligned)
- SLAs by tier — uptime, response, recovery
- Disaster recovery and business continuity plan