Privacy dossier / version 2026.05

Your data has a purpose, a place, and an exit.

A plain-language record of what RiskPulse collects, why it is used, where it moves, and how you can take control under the DPDP Act 2023.

Published / May 27, 2026Effective / May 27, 2026Jurisdiction / India
Data custody / live system
Lifecycle control / 01Live
Purpose defined

Collect with a reason.

Only what the product needs. Every movement stays attached to a stated purpose and an accountable control.

MINIMUM

Our privacy covenant

Three rules before the fine print.

01

DPDP Act 2023 aligned

Built around the Digital Personal Data Protection Act, 2023: clear notice, lawful purpose, and a named Grievance Officer.

02

India-hosted by default

Customer data lives in Firestore (asia-south1, Mumbai). API routes deploy to Vercel Mumbai (bom1).

03

You stay in control

Export, correct, or delete your data at any time. We never sell personal data.

P/01

Who we are

RiskPulse is a CyberScore platform for Indian SMEs operated by ZeroRisk Labs from Guwahati, Assam. ZeroRisk Labs is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act 2023") for the personal data we process through RiskPulse. This policy covers our website, dashboard, scan engine, public share links, insurer API, and customer communications.

P/02

Information we collect

We collect only what we need to deliver the CyberScore, the DPDP readiness check, monitoring, and insurer-facing reports.

Account information

Created when you sign up with email and password or Google, and when you complete onboarding.

  • Name, email address, and (optionally) phone number in E.164 format.
  • Business name, industry, city, and Indian state.
  • UI and report language preference (English, Hindi, or other Indian languages).
  • Communication preferences for email and WhatsApp alerts.

Domain and scan data

Generated each time you run a scan or add a domain to monitoring.

  • Domains you submit and the list of domains you track on your account.
  • Public signals collected by the scan engine: SSL/TLS configuration, DNS and email records (SPF, DKIM, DMARC), HTTP response headers, open ports and service banners, CVE matches against detected versions, reputation indicators, breach-corpus exposure for the domain, dark-web mentions, cloud-bucket discovery hints, and DPDP heuristics (privacy policy, cookie banner, grievance contact).
  • Derived outputs: CyberScore (0–850), category sub-scores, findings, plain-English remediation steps, AI-generated executive summaries (English and Hindi), and PDF reports.
  • Per-scan execution telemetry such as duration, coverage, and skipped checks.

Billing and subscription information

Used to manage paid plans (Starter, Professional, Enterprise) billed in Indian Rupees.

  • Razorpay customer and subscription identifiers, plan tier, and plan expiry.
  • Invoice metadata (amount, GST, billing date). Card and UPI details are collected and processed by Razorpay; RiskPulse never sees or stores them.

Team and collaboration data

When you invite teammates or share reports.

  • Email addresses of invitees, invite status, and role assignments.
  • Share-link tokens for public report URLs that you explicitly generate.

Usage, device, and security data

Collected automatically to keep the service reliable and safe.

  • IP address, browser, device type, operating system, and timezone.
  • Application logs, scan request metadata, rate-limit counters (Upstash Redis), and Firebase App Check tokens.
  • Authentication audit trail and admin action audit logs (append-only).
  • Cookies and local storage required for sign-in, session continuity, and CSRF protection.

Insurer API consumers

For underwriting partners using our read-only insurer API.

  • Organisation name, contact email, hashed bearer key, tier, and per-month query counts.
P/03

How we use your information

We process personal data for the lawful purposes set out below. Under the DPDP Act 2023 we rely on your consent (collected at signup and at specific opt-in points) and on legitimate uses such as performance of the contract, fraud prevention, and legal compliance.

  • Generate your CyberScore, findings, prioritised fix plan, and AI-written report.
  • Run weekly re-scans and alert you when your score drops or new risks appear.
  • Send transactional email (account, billing, scan completion) and, where opted in, WhatsApp alerts via the Meta WhatsApp Business API.
  • Authenticate users, enforce plan limits, prevent abuse, and operate App Check and rate limiting.
  • Provide insurer partners read-only access to a CyberScore and risk band only when you initiate the share or hold an active insurer integration.
  • Improve scan accuracy and reliability through aggregated, de-identified analysis.
  • Comply with applicable Indian law, respond to lawful requests, and enforce our Terms.
P/04

When we share information

We share personal data only with carefully selected sub-processors that help us run the service, with parties you explicitly choose, or where required by law.

  • Sub-processors that operate parts of our infrastructure (listed in Section 5).
  • Insurance partners or other third parties only when you generate a share link, accept a quote, or activate an insurer integration.
  • Government and law-enforcement authorities where disclosure is required by Indian law or to protect rights, safety, and the integrity of the service.
  • Acquirers in connection with a merger, acquisition, or restructuring of ZeroRisk Labs, with notice to affected users.
P/05

Sub-processors we rely on

We use established processors to deliver core functionality. Each is bound by contractual data protection terms.

  • Google Firebase and Google Cloud (Firestore, Authentication, Cloud Functions, Storage) — primary database and scan engine, region asia-south1 (Mumbai).
  • Vercel — hosting for the Next.js frontend and API routes, primary region bom1 (Mumbai).
  • Upstash Redis — rate limiting and short-lived caches.
  • Razorpay — subscription billing and payment processing.
  • Resend — transactional email delivery.
  • Meta (WhatsApp Business API) — WhatsApp alerts for users who opt in.
  • Google Gemini (Generative Language API) — generation of plain-English and Hindi report summaries from scan results.
  • External threat-intelligence sources used during scans (e.g., breach corpus, reputation, dark-web feeds) — queried using the domain you submit.
P/06

Data residency and cross-border transfers

Customer data is primarily stored in India. Our Firestore database, Cloud Functions, and Vercel deployment region are in Mumbai (asia-south1 / bom1). Some sub-processors (for example Google Gemini, Resend, and Razorpay) may process limited data outside India in line with their public infrastructure. Where transfers occur we rely on the contractual safeguards offered by these providers and on the cross-border framework permitted under the DPDP Act 2023.

P/07

How long we keep your data

Retention periods are tied to the purpose of processing. We retain data for as long as your account is active, and for a limited period afterwards as required by law or for legitimate business needs.

  • Account profile: kept while your account is active and for up to 90 days after deletion to handle reversal requests, then erased or anonymised.
  • Scan results, findings, and snapshots: retained for the lifetime of the account on free plans; on paid plans the active monitoring window matches your plan retention.
  • Score history: aggregated daily snapshots are kept for trend charts; you can request earlier deletion.
  • Billing records: retained for the period required by Indian tax and accounting law (typically eight years).
  • Audit logs and security events: retained for up to 24 months for fraud prevention and incident response.
  • Backups: residual copies in encrypted backups are deleted within their normal rotation window.
P/08

How we protect your data

We apply layered technical and organisational safeguards. No internet service can guarantee absolute security, but we work hard to reduce risk.

  • TLS 1.2+ in transit and provider-managed encryption at rest for Firestore, Cloud Storage, and Upstash.
  • Role-based access controls, least-privilege service accounts, and Custom-Claim gated admin routes.
  • Firebase App Check on mutating API endpoints and constant-time HMAC verification for webhooks.
  • Upstash Redis rate limiting (fail-closed in production) on authentication and sensitive endpoints.
  • Append-only admin audit logs for sensitive actions; scoped client SDK usage that never holds Admin credentials.
  • Secrets stored in environment variables and managed secrets, with periodic rotation.
P/09

Cookies and similar technologies

We use a small number of cookies and local-storage entries that are essential to the service: authentication session cookies issued by Firebase Auth, CSRF protection tokens, and preference storage for your language and dashboard layout. We do not use third-party advertising or cross-site tracking cookies. Where regional law requires it, we surface a consent prompt.

P/10

Your rights as a Data Principal

Under the DPDP Act 2023 you have the following rights with respect to the personal data we process about you. We will respond within 30 days of a verified request.

  • Right to access a summary of the personal data we hold and the processing carried out.
  • Right to correction, completion, updating, or erasure of your personal data.
  • Right to grievance redressal — escalate to our Grievance Officer (details below).
  • Right to nominate another individual to exercise your rights in case of death or incapacity.
  • Right to withdraw consent for any processing based on consent, at any time, without affecting prior lawful processing.
  • Right to data portability — request a machine-readable export of your account and scan data.
P/11

Children and protected groups

RiskPulse is built for businesses and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a minor has shared personal data with us, contact our Grievance Officer and we will erase it.

P/12

Scans of third-party domains

You must only submit domains you own, operate, or are authorised to assess. RiskPulse uses only public, non-intrusive signals (DNS lookups, public ports, public web pages, public corpora). We do not perform exploitative testing. Misuse may result in suspension and may breach the Information Technology Act, 2000.

P/13

Changes to this policy

We may update this policy as the product, our sub-processors, or applicable law evolve. Material changes will be highlighted on this page and, where appropriate, notified by email. The "Last updated" date at the top reflects the most recent revision.

Escalation route / P14

A named human, not a support maze.

In line with Section 8(9) of the DPDP Act 2023, you can contact our Grievance Officer for any concern, complaint, or rights request relating to your personal data. We will acknowledge within 72 hours and resolve within 30 days.

Officer
Grievance Officer, ZeroRisk Labs
Email
grievance@riskpulse.tech
Address
ZeroRisk Labs, Guwahati, Assam, India
Resolution window
Within 30 days

If you are not satisfied with our response, you may approach the Data Protection Board of India under the DPDP Act 2023.

Privacy support / one business dayAsk us about your data.↗