Security, privacy and reliability — documented, not promised

Provider

Emergent Cloud (Kubernetes) with MongoDB managed database

Primary region

India (Mumbai, ap-south-1)

Data residency

Customer data is stored in India by default. Enterprise plans can request EU (Frankfurt) or UAE hosting.

Cdn edge

Global edge for static assets only — no customer data cached at the edge.

In transit

TLS 1.2+ on every endpoint (HSTS enabled)

At rest

AES-256 volume encryption on database and object storage

Secrets

Environment-scoped secrets, never committed to source control

Passwords

bcrypt (cost 12) — plaintext never stored

Api keys

Hashed at rest; shown once at creation; webhook payloads HMAC-SHA256 signed

Backups

Automated daily snapshots retained 30 days; point-in-time recovery for the last 7 days

Rpo

≤ 24 hours (≤ 1 hour with point-in-time recovery)

Rto

≤ 8 hours for Professional, ≤ 4 hours for Enterprise

Dr test

Restore drill performed quarterly; last drill result available on request

Sla

Starter: 99.5% · Professional: 99.9% · Enterprise: 99.95% with service credits

Status page

/status

Maintenance window

Sundays 02:00–04:00 IST, announced 72 h in advance

Rbac

7-level role model (Super Admin → Free User) with per-module permissions

Mfa

Authenticator-app TOTP + backup codes, SMS OTP; organisation-wide enforcement

Sso

Google Workspace and Microsoft Entra ID sign-in today; SAML 2.0 / OIDC (Okta, Entra) for Enterprise on request

Ip allowlist

Per-organisation IP allow-list enforced at sign-in

Audit logs

Immutable audit trail with CSV export for every tenant

Sessions

Short-lived JWT access tokens with refresh rotation and force-logout

Sdlc

Peer-reviewed changes, automated test suites on every release, dependency scanning

Vulnerability disclosure

security@mydbfm.com — acknowledged within 2 business days

Pen test

Third-party penetration test scheduled annually; summary letter available under NDA

Laws

India DPDPA 2023 · EU GDPR · UK GDPR

Dpo contact

privacy@mydbfm.com

Data subject requests

Export and deletion honoured within 30 days

Retention

Customer data deleted within 30 days of contract end unless legally required

Gap assessment complete; Stage 1 audit targeted Q4 2026

Evidence: Statement of Applicability available under NDA

Controls mapped to Trust Services Criteria; observation period starts after ISO Stage 1

Evidence: Bridge letter available on request

DPA, sub-processor list and data-subject process published

Evidence: This page

Consent, notice and grievance officer processes in place

Evidence: Privacy policy

Product workflows map to ISO 55001 clauses; the certification is held by customers, not the software

Evidence: Mapping sheet on request

Dun & Bradstreet verified business identity

Evidence: Shown in app footer