Trust
Security by design, not by promise.
We protect your residents' data the way we'd want our own protected.
Data protection
- Built to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act). Privacy policy enumerates collected data, purposes, retention, and data-subject rights.
- Data is hosted in the Asia-Pacific (Supabase ap-south region) — no cross-border transfer required.
- Every connection is encrypted in transit (TLS). Stored data is encrypted at rest by our database host, Supabase.
Access control
- Four roles, scoped exactly: Super Admin, RWA Admin, Counsellor, Resident.
- Residents never see admin pages. Admins never see other societies. Counsellors never see your finances.
- Changing your password signs you out on every other device.
Society separation
- Every request is checked by the app and limited to the signed-in person's own society.
- Direct access to the database from outside the app is blocked: row-level security is switched on for every table, with no rule that lets an outside client read or write.
- Automated tests check that an admin of one society cannot read or change another society's data.
Operations
- Production errors surface in Sentry within seconds — we know about issues before users report them.
- Rate-limited login and forgot-password flows to resist brute-force attacks.
Compliance posture
- DPDP Act 2023 — the privacy policy lists your rights (access, correction, erasure, nomination). Residents withdraw consent and request erasure themselves, from their privacy settings; for a copy of their data they ask their RWA Admin or our Grievance Officer.
- Information Technology Act 2000 — data privacy and security obligations.
- RBI / NPCI rules for any UPI surface — your money never transits our systems on UPI claim flow.
- Note: We are DPDP-aligned, not formally certified. Our gap list (consent record metadata, self-service DSAR, breach-response runbook, named DPO) is published with each release. Email security@rwaconnect360.com for the current status.
Responsible disclosure
- Found a security issue? We want to know.
- Email security@rwaconnect360.com with details — we acknowledge within 48 hours.
- We don't pursue legal action against good-faith researchers.
Want a deeper dive (data flow diagrams, architecture, audit reports)? Email security@rwaconnect360.com — we'll send a security pack under NDA.
Ready to digitise your society?
Set up takes about two minutes. The 14-day trial includes every feature of the plan you choose. No credit card.