Security, compliance, and data governance — written for reviewers, not marketing audiences.
Every section below carries a real brief, not a label — written for enterprise security reviewers, InfoSec teams, and procurement questionnaires.
Security Architecture
ISO 27001-certified infrastructure. AES-256 encryption at rest, TLS 1.3 in transit. HSM-backed key management for all signing operations — no private keys stored in software.
- AES-256 encryption at rest across all data stores
- TLS 1.3 enforced for all API and browser connections
- HSM-backed key management — no software-stored private keys
- Service-tier network segmentation with WAF and DDoS protection
Compliance Frameworks
Operating under multiple frameworks, maintained operationally rather than as point-in-time certifications.
- ISO 27001 — Information Security Management System
- CCA Licensed CA Partner — IT Act 2000 (India)
- UIDAI ASP Partner — Aadhaar Act compliance (India)
- DPDP Act 2023 alignment (India)
- UAE PDPL (Federal Decree-Law No. 45 of 2021) alignment
- GDPR alignment for EU-data-subject processing
- SOC 2 readiness in progress
Data Residency
India-jurisdiction data stored within India — no default cross-border transfer.
- India-jurisdiction data stored within India
- UAE deployments on AE-region infrastructure
- Saudi deployments on SA-region infrastructure
- EU deployments on EU-region infrastructure, with GDPR-compliant transfer mechanisms (SCCs/adequacy)
- All cross-border transfers governed by explicit Data Processing Agreements
Business Continuity
Multi-zone redundancy with automated failover. Annual DR drills with documented outcomes.
- Multi-zone redundancy with automated failover
- RTO: 4 hours · RPO: 1 hour
- Annual DR drills with documented results
- Backup replication every 15 minutes
- Geographically separated DR site
Incident Response
Dedicated security incident channel with documented acknowledgement and escalation timelines.
- Dedicated channel: security@fdssonline.com
- Acknowledgement within 2 hours of report
- Root-cause communication within 48 hours
- Critical incidents escalated to CERT-In as required (India) — UAE/EU escalation paths to be confirmed
Service Availability
Contractual uptime SLA for signing and verification APIs.
- 99.9% uptime SLA for signing and verification APIs
- 4-hour response SLA for support enquiries
- Planned maintenance communicated 72 hours in advance
- Status updates via email and Slack during incidents
Certificate Security
All certificate private keys protected by FIPS 140-2 Level 3 HSMs.
- FIPS 140-2 Level 3 HSMs for all private key protection
- OCSP and CRL revocation, updated every 4 hours
- Dual-control, split-knowledge key ceremony for root operations
- Automated expiry alerts for certificate lifecycle management
Privacy Controls
For full detail on consent management, DSAR handling, and cross-border safeguards, see the Privacy & Consent page.
- Consent lifecycle management via the Consent Manager platform
- DSAR / data-subject-request handling with documented turnaround SLAs
- Data minimisation by design in all collection flows
- Cross-border transfer safeguards with explicit DPAs