Trust & security

What we run, what we don’t, and what we’ll never claim.

We hold no certification of any kind today. Here are the controls we run instead, stated so your CA and your auditor can check them.

Request the security overview Sub-processors

Your data stays in India.

Mumbai (ap-south-1) across 3 availability zones, including backups, logs and evidence.

Your own database.

It is never shared. Sandboxes are single-tenant and destroyed after use.

DPDP.

We are your processor and you are the fiduciary.
A DPA is signed before the first real record.
The sub-processor list is published, with notice before changes.
Erasure is done within 72 hours.
We build to the obligations now, ahead of 13 May 2027.

Never used to train a model.

Not ours, not anyone’s.

Access.

Support access is named, time-boxed and logged.
Credentials are minted per call and expire in 10 minutes.
Staff MFA is mandatory.

Incidents.

CERT-In report within 6 hours, a written update within 72 hours, and a named person, not a status page.

Audit.

Hash-chained proof records kept 7 years on write-once storage in India, and 180-day logs.

Certifications, honestly.

We hold no SOC 2 or ISO 27001 certification today. We will publish a dated plan only when one exists.

Downloads

Security overview PDF · DPA template · sub-processor list. Sent on request while we are in the design-partner phase.

Request documents

Proof record

What is recorded for every change, and how the chain shows any later edit.

Anatomy of a proof record

Responsible disclosure

Found a vulnerability? Write to security@elan1.ai. We reply within 2 working days and never take legal action against good-faith research.

Start with one process. Add the next when it holds.

10 design-partner slots for Phase 1. 90 days free, onboarding done for you, a named founder on WhatsApp.

Apply as a design partner Talk to us

Not for service firms under ₹1 crore, firms above ₹250 crore, or anyone whose CA won’t take a call.

What we run, what we don’t, and what we’ll never claim.

Your data stays in India.

Your own database.

DPDP.

Never used to train a model.

Access.

Incidents.

Audit.

Certifications, honestly.

Downloads

Proof record

Responsible disclosure

Further reading

DPDP Act for SMEs: what to do before 13 May 2027

MCA audit trail rule: what Rule 3(1) and Rule 11(g) require

What is an ERP change gate?

Start with one process. Add the next when it holds.

What we run, what we don’t, and what we’ll never claim.

Your data stays in India.

Your own database.

DPDP.

Never used to train a model.

Access.

Incidents.

Audit.

Certifications, honestly.

Downloads

Proof record

Responsible disclosure

Further reading

DPDP Act for SMEs: what to do before 13 May 2027

MCA audit trail rule: what Rule 3(1) and Rule 11(g) require

What is an ERP change gate?

Start with one process. Add the next when it holds.