Trust centre
Tenant boundaries, access decisions, retention and privacy rights travel with the workflow—so control evidence is part of the operating record.
CONTROL PRINCIPLE
Trace the decision
Who, what, when, and the exact rule or model version behind it.
Control model
Security controls are applied where identity, data and decisions move—not added later as a reporting layer.
India-primary cells are designed for AWS ap-south-1 across three availability zones. Future-market deployments use regional cells so residency and failure boundaries remain explicit.
A signed tenant context follows every authorised request through services, data access, events and search—not a filter added at the screen.
Data is encrypted in transit and at rest. Evidence requiring durable retention is stored with WORM controls designed to support customs retention of five years or more.
Role-based access and maker-checker segregation keep preparation, filing and payment authority separate. SCIM supports governed joiner, mover and leaver processes.
DPDP Act 2023 and DPDP Rules 2025 alignment is designed into consent records, rights-request workflows, breach notification and retention decisions.
Every governed action records who acted, what changed, when it changed and which rule, model or policy version supported the decision.
A privacy request does not silently erase records that law requires the organisation to retain. The rights workflow records the applicable basis, scope, decision and authorised response.
Independent assurance
These programmes are planned control-evidence milestones. The placeholder remains visible until Ralixar publishes a verified status.
Status: [[STATUS]]
No certification claim is made while this status is unresolved.
Status: [[STATUS]]
No certification claim is made while this status is unresolved.
Security review
Request the security whitepaper for a structured view of the intended architecture, responsibilities and evidence programme.
