Trust centre
Your data stays yours. Here is how.
What is in place, what we tested and when, and what we have not done yet.
Zero access to your data
Once you go live, our team does not open your records. For a fix, you grant access for that job, and it ends with the job.
- A dedicated system for each client, never a shared one
- A full export in open formats within 30 days of notice
- No licence key that switches anything off
- Hosted in your region, one of 9 cloud regions, or on your own server
- 79.5 s
- from backup files to a working system in our restore drill, 22 Oct 2026
- 24 h / 4 h
- most data you could lose, and time to restore, on the Standard tier
- AES-256
- encryption of PAN, Aadhaar, passport and bank numbers, and of backups
- 30 days
- to a full export in open formats after your notice
Eight areas
What is in place, with the proof.
Each panel says what works today and how we know. Open one for the detail, the numbers and the dates.
Data ownership and exit
Yours to keep. Yours to take.
Once you go live, our team does not open your records. For a fix, you grant access for that job, and it ends with the job.
Read data ownershipSecurity
Controls you can check in the product
- Two-factor sign-in, recovery codes
- Roles checked on the server
- Tamper-evident audit trail, 8 years
Live in the product
Backups and recovery
Daily backups, and a timed restore
79.5 sbackup files to a usable system
- 14 days on the server
- 90 days off it
- RPO 24 h
- RTO 4 h
Restore drill, 22 Oct 2026
Responsible AI
Sees what you can see. Changes nothing unasked.
Live in the product
Uptime
Targets for MyRecords Cloud
99.5% on Lite, Small and Medium99.9% on Large
Targets, not the contract
- Privacy and the DPDP ActConsent records with withdrawal, erase requests, data export, grievance and breach contacts, for India’s DPDP Act.Live in the product
- Compliance proofIndia GST: IGST for inter-state supplies, CGST + SGST within the state, GST tax invoice by default.Checked 3 Nov 2026
- AccessibilityThis website aims for WCAG 2.2 AA, tested with automated checks and by keyboard.Statement of 1 Nov 2026
In short
Your data stays yours: a dedicated system for each client, zero access by our team after go-live, and a full export in open formats within 30 days of notice. Two-factor sign-in, a tamper-evident audit trail, AES-256-GCM encryption of PAN, Aadhaar, passport and bank numbers, and encrypted backups are live. Our restore drill rebuilt a working system from backup files in 79.5 seconds. We have no ISO 27001 or SOC 2 certificate and no external penetration test yet.
Said plainly
Not done yet. Plan around it.
We will add the date here when each one is done. Until then, the answer to each is no.
See the roadmapOpen items6
- ISO 27001 certificateNot yet
- SOC 2 reportNot yet
- External penetration test (VAPT)Not yet
- A public status pageNot yet
- A chartered accountant’s review of our GST pagesNot yet
- A restore of a real client’s data (the drill used our demo company)Not yet
For procurement teams
Send us your questionnaire.
We answer from what is on these pages and in the product, and we say “no” where the answer is no.
Questions
Questions people ask
01Can your team see our data?
No. Once you go live, our team does not open your records. For a fix, you grant access for that job, and it ends with the job. See data ownership and exit.
02Who owns the data I put into MyRecords?
You do. We use it only to run and support your system. If you leave, you get a full export in open formats within 30 days of your notice.
03Is MyRecords certified to ISO 27001 or SOC 2?
No, not yet, and it has not had an external penetration test. Our security reviews so far are internal. The controls that are in place are listed on the security page.
04How much data could we lose if a server fails?
On the Standard tier, at most one day’s work (RPO 24 h), and we aim to have you working again within 4 hours (RTO 4 h). Larger clients can choose a managed database that cuts the possible loss to minutes.
05Where is our data kept?
On your own server, or on MyRecords Cloud in the region you choose: India, the US, Europe, the UK, Singapore, Sydney, the UAE, Saudi Arabia or South Africa. Indian clients are hosted in India; EU and UK clients are hosted in the EU or UK, with a data-processing agreement. Each client has a dedicated system, not a share of a common database.
Last updated
Next step
Ask us the hard questions.
A live demo on our sample company, with our team. Bring your security and data questions; we answer them.
Live demo
Book a walk-through
- On our sample company, for your kind of work
- A quote for the modules you need
- Your questions, answered by our team