Trust & Compliance
Identity and KYC data is some of the most sensitive data a business holds. Attestr is independently certified for information security and quality management, and built around India's Digital Personal Data Protection Act.
Certifications & testing
Information Security Management
Certifies Attestr's information security management system (ISMS) covering the digital onboarding, eKYC automation and integration platform.
Quality Management System
Certifies the quality management system covering Attestr's software solutions for onboarding, eKYC automation and integration services.
Independent Penetration Testing
Our production platform is independently tested for vulnerabilities by Bachao.AI (Dhisattva AI Pvt Ltd), using black-box and authenticated grey-box testing, followed by remediation re-tests.
All Critical, High, Medium and Low findings closed — fixed and re-verified, or formally risk-accepted. Two informational observations remain, neither with a data- or system-impact path.
0
Open critical
0
Open high
0
Open medium
0
Open low
Certificates are held by Pegadroid IQ Solutions Private Limited, the company that operates Attestr. Copies of the ISO certificates and the VAPT certificate are available to customers and prospects on request.
DPDPA
Attestr's data handling practices align with India's Digital Personal Data Protection Act, 2023 — consent-first processing, purpose limitation, data minimisation and data principal rights.
Personal data is processed only against a clear, specific consent — and Attestr's Consent Data Processor lets you capture and prove that consent for your own users too.
Data collected for a verification is used for that verification — never sold, and never repurposed for marketing.
Each check collects and returns only what that verification needs — not a full profile of the person behind it.
Requests to access, correct or erase personal data, and grievances, have a named route to a team equipped to handle them.
Need to prove consent for your own users? Attestr's Consent Data Processor gives you hosted consent pages, a consent audit trail and webhooks.
DPDPA Consent Data ProcessorPolicies & documentation
Our commitments on data protection, storage and security are published in full — the same commitments we make in our client agreements.
Stored in India
All verification data lives in AWS Mumbai; backups and failover stay in India.
Data Storage PolicyEncrypted at rest and in transit
AES-256-GCM at rest with AWS KMS; TLS 1.2+ in transit.
How data is protectedKept only as long as consent
Single-use checks aren't stored; reusable consents default to 7 working days.
Retention periodsA named Grievance Officer
Harika Pogaku, reachable at harika.pogaku@attestr.com.
Your rightsTerms of Service
Prepaid packs, acceptable use, service levels, liability and how disputes are resolved.
Privacy Policy
What personal data we process as Data Fiduciary and Data Processor, and your rights under the DPDP Act.
Data Processing Addendum
Roles, client consent obligations, the consent input schema, breach handling and audit rights.
Data Storage Policy
What we store, for how long by consent type, where it lives, and how it is deleted.
Cookie Policy
Strictly necessary cookies only — no advertising or analytics tracking.
Sub-processors
Every third party that processes data for us, what it does and where.
For developers and compliance teams
How our DPDPA controls work at the API level — consent registration, lifecycle, revocation and audit trails.
FAQ
Pegadroid IQ Solutions Private Limited, the registered company that operates Attestr. The certificates cover the digital onboarding, eKYC automation and integration platform.
Yes. Bachao.AI (Dhisattva AI Pvt Ltd) performed a vulnerability assessment and penetration test of our production platform (attestr.com production — 3 hosts, 2,860 checks), first on 15 August 2026 with re-tests on 1, 4 and 8 September 2026. All critical, high, medium and low findings were closed, and certificate BVPT-ATT-2026-0908 was issued on 8 September 2026. The certificate is available on request.
No. India's Digital Personal Data Protection Act, 2023 has no accredited certification scheme, so any "DPDPA certified" claim should be treated with caution. Attestr states DPDPA compliance as a self-declared commitment, backed by its consent-first practices and its ISO 27001-certified security programme.
No. Personal information is used to provide the verification services requested and is not sold or rented to anyone.
All verification data is stored in India, in the AWS Mumbai region, encrypted with AES-256-GCM. Single-use verifications are not retained in identifiable form; reusable consents are stored only if the client enables it — 7 working days by default, never beyond the consent's validity. Full details are in our Data Storage Policy.
For the people our clients verify, the client is the Data Fiduciary and Attestr is its Data Processor — and, where the client opts in, a Consent Collection Facilitator through hosted consent pages. For our own customers' account and billing data, Attestr is the Data Fiduciary.
Email our Grievance Officer at harika.pogaku@attestr.com with the subject "Data Protection Request". If a business verified you using Attestr, that business is your Data Fiduciary — contact it first; we will help route your request.
Can't find what you need? See all our policies or email harika.pogaku@attestr.com.
Talk to us for certificate copies, a security questionnaire, or a walkthrough of how Attestr handles identity data.