Isolation
A dedicated database, subdomain, encryption key and storage area for every customer. Your data never shares a table with anyone else's.
Trust centre
Built so that trust isn't a promise. It's a property.
People will only speak up if they believe it's safe. So we designed TrustToSpeak so that confidentiality is enforced by architecture, not by policy, and can be proven, not just claimed.
OWASP ASVS aligned
DPDP Act 2023 ready
Encryption at rest & in transit
Six pillars
How we protect every case.
Encryption
Personal data is encrypted in the application before it reaches the database, so anyone with database access sees only ciphertext.
Access control
Every request passes identity, role, location, assignment, stage and data-scope checks. Fail one, and access is denied.
Auditability
An append-only, hash-chained log of every action, including who read the audit log itself.
Evidence integrity
SHA-256 fingerprints at upload, short-lived access links, reasoned downloads and write-once archival.
Data lifecycle
Retention per policy, legal holds that block deletion, and multi-approval erasure for data-principal requests.
Envelope encryption
Your complainants' names are unreadable, even to us.
Each organisation has its own master key in a managed key service. Every sensitive field is encrypted with a fresh data key, which is itself encrypted by your master key.
- Encrypted: names, emails and phone numbers of users and complainants; the full complaint form; security words; evidence file names and descriptions; investigation notes; chat messages; stage-form submissions.
- Left readable only where needed to run the workflow: case number, stage, policy, timestamps and SLA counters.
Organisation master keyUnique per customer · never leaves key service
Data encryption keyGenerated per write · stored encrypted
Encrypted field"Priya S." → 8f1e0c9a…b7 in the databaseCiphertext
Access control
Six checks before anyone sees a case.
Access isn't granted by role alone. A committee member can open a case only if they're assigned to it, and only take actions the current stage allows. People who aren't authorised can't even confirm the case exists.
- Committee members never see admin screens, not even greyed out.
- External members accept digitally before access starts, and lose it automatically at closure.
- Auditors get read-only sealed snapshots.
AuthenticatedValid session, secure httpOnly cookies
Role permits actionAdmin, case manager, committee, auditor…
Location in scopeRegional users see only their branchesNew
Assigned to this caseExplicit, COI-checked assignment
Stage allows itWorkflow decides what's possible now
Data scopedEvery query bound to your organisation
Tamper-evident audit
If anyone changes history, the maths will tell you.
Every action becomes an entry whose hash includes the previous entry's hash. The database itself refuses updates and deletes on the log, and any tampering outside it breaks the chain.
- Every view, upload, transition and download is recorded.
- Reading the audit log is itself audited.
- One-click chain verification for auditors and regulators.
prev 6b1f…a903hash 2c7e…41d8prev 2c7e…41d8hash 9a04…e6c1prev 9a04…e6c1hash f35d…08b2Compliance
Aligned with the laws you answer to.
POSH Act, 2013
Internal Committee per branch, statutory inquiry and action timelines, external member participation, confidentiality of proceedings and annual reporting.
Companies Act, 2013 (Sec. 177) & SEBI LODR
A vigil mechanism with protected anonymity, an ethics committee and records that support board and audit-committee oversight.
DPDP Act, 2023
Purpose-bound collection, encryption of personal data, retention limits, and a multi-approval workflow for erasure requests that respects legal holds.
Application security
- Strict input validation on every API endpoint
- Hardened HTTP security headers (CSP, HSTS, frame protection)
- Rate limiting, stricter on sign-in and upload
- No raw database queries built from user input
- Secrets held in a managed secrets service, never in code
Retention defaults
- POSH: 7 years, legal lock
- Whistleblower: 8 years, legal lock
- Disciplinary: 5 years, legal lock
- Grievance & Code of Conduct: 3 years, early deletion with 2 approvals
- Onboarding: 2 years
Need our security questionnaire, architecture overview or a DPA for your procurement team? Ask us and we'll send it within one business day.
Get started
Make speaking up safe, at every branch, from day one.
See how TrustToSpeak takes a complaint from a QR scan to a closed, audit-ready case in a 30-minute walkthrough tailored to your policies.
- 30-minute walkthrough
- Private sandbox
- Live in a day