Security and data residency

What OptProof stores, where, and how it is protected, plus the settings you should configure on your side. For our wider security posture and sub-processors, see the security page.

Where data lives#

OptProof runs on one server in AWS Mumbai (ap-south-1, Amazon Lightsail). The database, backups, exports and the evidence bucket are all in AWS Mumbai. Personal data is not stored or replicated outside India.

Store	What is in it
Postgres database (on the server)	Your workspace configuration, the consent ledger, rights requests and registers. Every table that belongs to a workspace is isolated with row-level security.
Redis (on the server)	The job queue for webhooks, connector sync, emails and scheduled jobs.
Backups bucket (Amazon S3, Mumbai)	Encrypted nightly database backups.
Evidence bucket (Amazon S3, Mumbai)	Daily signed anchors, in S3 Object Lock compliance mode: nobody, including OptProof, can overwrite or delete them before the retention period ends.
Exports bucket (Amazon S3, Mumbai)	Evidence packs and CSV exports you request, available through short-lived download links.

Two services handle data outside this setup:

Email (one-time codes, request confirmations, reminders) is sent through Hostinger, which stores mailboxes and backups in the European Union (France or Germany).
AI features send text to Anthropic, outside India, after names, phone numbers and emails are replaced with placeholders.

Both are listed on the sub-processors page.

Running on one server keeps the setup simple, but there is no standby server yet: if the server fails, OptProof is unavailable until it is restored from the latest backup.

What the ledger stores#

The ledger is built to hold as little personal data as possible:

People are identified by a principal_ref: an HMAC-SHA-256 of the normalised phone number or email, keyed with a secret unique to your workspace. The raw value never enters the ledger, receipts, webhooks or logs.
Browsers are identified by a random device_ref with no link to the person until you link it.
Receipts contain event ids, hashes, purposes, the notice version, language, channel and time. Nothing about the person.
Contact details, when you choose to store them so people can sign in by OTP, are kept in a separate table, encrypted.

Encryption#

In transit: HTTPS on every endpoint, with HSTS and Let's Encrypt certificates.
At rest: backups and files in S3 are encrypted. Contact details and connector credentials are additionally encrypted per field with envelope encryption (AES-256-GCM data keys protected by AWS KMS in Mumbai), so a copy of the database alone does not reveal them.
Keys: secret API keys are stored only as argon2id hashes and shown once. Receipt signing keys live in AWS Secrets Manager in Mumbai and are used only by the OptProof service that signs receipts.

Append-only evidence#

Consent events, receipts, anchors, audit logs and record-access logs can only be added to, never changed or deleted. This is enforced in the database itself, by triggers and by the application's database role having no update or delete rights on those tables. Corrections are new events.

Consent evidence is kept for 7 years by default, which you can change. Processing logs are kept for at least 365 days. Both values are product defaults pending counsel review.

Access by OptProof staff#

OptProof staff sign in through a separate system with two-factor authentication. Support access to your workspace needs a recorded reason, lasts at most 30 minutes, shows a visible banner, and every action is written to the audit log.

AI features#

Where OptProof uses AI (drafting notices, translating, classifying forms found by the scanner), names, phone numbers and emails are removed before anything is sent to the model. Every AI output that faces your users goes to a review queue and needs a human to approve it.

What you should configure#

Setting	Why
Allowed origins on each web property	The publishable key only works from these origins. Keep the list to your real domains.
Secret key storage	Keep `sk_` keys in your server’s secret store, never in source control, web pages or apps.
Key rotation	Rotate secret keys when someone leaves or a key may have leaked. Rotation has an overlap window so you can deploy without downtime.
Two-factor authentication	Required for workspace owners. Turn it on for everyone with admin or DPO access.
Roles	Give front-desk staff the `staff` role (kiosk only) and read-only users `viewer`.
Webhook signature checks	Verify every delivery and reject old timestamps. See Webhooks.
Content Security Policy	Allow `https://cdn.optproof.in` in `script-src` and `https://api.optproof.in` in `connect-src`. See the widget CSP notes.

Report a vulnerability#

If you find a security issue, write to security@optproof.in with the details and steps to reproduce. Please give us reasonable time to fix it before you share it publicly.