Security & Compliance

At DigitalYaan, security, privacy, and regulatory compliance are foundational engineering principles. We build enterprise digital platforms and digital health systems with mathematical precision, end-to-end cryptography, and absolute adherence to global privacy mandates.

1. Cryptographic Standards & Key Management

Client data is protected using zero-trust cryptographic safeguards across every compute and storage layer:

• Data in Transit (TLS 1.3): Strict enforcement of TLS 1.3 across all public and internal service boundaries with modern forward-secrecy cipher suites. Legacy ciphers are systematically disabled.
• Data at Rest (AES-256-GCM): Databases, cache partitions, and object storage volumes are encrypted with AES-256-GCM authenticated encryption utilizing hardware-level acceleration.
• Key Wrapping & Ephemeral Exchange: Inter-service health records exchange utilizes Elliptic Curve Diffie-Hellman (ECDH curve25519) key pairs with ephemeral session tokens.
• Hardware Security Modules (HSM): Master encryption keys reside within Cloud KMS / HSM with automated 90-day rotation schedules and strict least-privilege IAM policies.

"Encryption is not a checkbox; it is engineered directly into our data models, database serialization layers, and network interfaces."

2. Ayushman Bharat Digital Mission (ABDM) Healthcare Compliance

We build certified hospital information software (HMS) that interfaces with the National Health Authority (NHA) digital health grid across all three core milestones:

• Milestone 1 (M1) - ABHA Identity: Real-time ABHA Number and ABHA Address creation via Aadhaar OTP and Mobile OTP authentication, alongside counter-based Scan-and-Share QR check-in flows.
• Milestone 2 (M2) - Health Information Provider (HIP): Automated serialization of prescriptions, diagnostic lab reports, and discharge summaries into HL7 FHIR R4 JSON bundles, securely pushed to patient health lockers.
• Milestone 3 (M3) - Health Information User (HIU): Secure doctor consultation portals capable of requesting, verifying cryptographic consent artifacts, and decrypting historic medical records.

3. India Digital Personal Data Protection (DPDP) Act 2023

Our software architectures comply with India’s Digital Personal Data Protection Act 2023, enforcing transparent data governance:

• Clear Notice & Purpose Limitation: Transparent, itemized consent notices in easily understandable terms. Personal data is collected solely for specified business needs.
• Data Principal Self-Service Rights: Native mechanisms for users to view, correct, update, export, and request deletion of their recorded data.
• Automated Data Retention & Purging: Scheduled cron workers that automatically purge inactive and expired operational data according to agreed regulatory schedules.
• Grievance Redressal: Dedicated Data Protection Officer (DPO) and structured grievance acknowledgment within 24 hours.

4. Global Compliance Frameworks (HIPAA & ISO 27001)

Our software development life cycle (SDLC) incorporates international security benchmarks:

• HIPAA Alignment: Administrative, Physical, and Technical safeguards protecting Electronic Protected Health Information (ePHI). Immutable audit logs track every record view, edit, and export.
• ISO/IEC 27001:2022 Principles: Systematic risk assessments, secure coding guidelines, automated dependency vulnerability scanners, and strict change management.
• SOC 2 Type II Controls: Multi-factor authentication (MFA), role-based access control (RBAC), and automated continuous compliance monitoring.

5. Cloud Infrastructure Resilience & 99.9% Uptime SLA

To guarantee business continuity, all applications run within hardened cloud environments:

• VPC Isolation & Edge WAF: Multi-tier VPC topologies with private subnets for persistent stores. Edge WAF filters volumetric DDoS attacks, SQL injection, and XSS exploits.
• Automated Hourly Offsite Backups: Daily and hourly snapshots with point-in-time recovery (PITR) replicated to geographically distinct storage regions.
• Recovery Objectives: Target Recovery Time Objective (RTO) of < 30 minutes and Recovery Point Objective (RPO) of < 1 hour for mission-critical deployments.

6. Vulnerability Disclosure & Security Contacts

We actively collaborate with security researchers and maintain a rapid response incident protocol. If you identify a potential security issue, please contact our security team:

• Email: security@digitalyaan.com
• Initial Response SLA: Within 24 business hours.
• Safe Harbor: We provide full safe-harbor protection for good-faith security vulnerability research conducted within ethical guidelines.