Security
Security you can show your client.
The controls, defaults, and reviews behind ProjectSathi. Updated as our posture evolves.
Encryption
TLS 1.2+ in transit. AES-256 at rest. Database backups encrypted with rotated keys.
Access control
Role-based access per project. SSO and audit trail on Enterprise. Least-privilege production access.
Hosting
Hosted on AWS Mumbai region. Data stays in India unless you ask otherwise.
Backups
Automated daily backups. 30-day point-in-time recovery on Growth and above.
Audit & monitoring
Application and infrastructure logs retained for 90 days. Anomaly alerts on production access.
Vulnerability management
Continuous dependency scanning. Quarterly third-party penetration tests on Enterprise.
Data ownership & portability
Your data is yours. Export projects, BOQs, attendance, billing, and payroll to Excel or CSV at any time — and we help you export everything within 30 days of termination, at no charge.
Sub-processors
Third parties that process customer data on our behalf. This list is maintained as our infrastructure changes; write to security@projectsathi.org for the complete current list, including communication providers, as part of a security review or DPA.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database and encrypted backups | Mumbai region (ap-south-1), India |
Need a deeper review?
Enterprise customers get a security review, signed DPA, and a quarterly briefing on our security roadmap. Write to security@projectsathi.org to start.