Security & Data Protection

1 Indian Sovereign Cloud Hosting (Data Residency)

In compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Reserve Bank of India (RBI) data localization guidelines, all primary database clusters, application servers, and automated snapshot archives managed by AH&V Software are hosted strictly on Indian soil within certified tier-4 data centers:

• Primary Cloud Regions: Amazon Web Services (AWS) Mumbai region (ap-south-1) and DigitalOcean Bangalore datacenter.
• Zero Cross-Border Data Transfer: Sensitive citizen data, payroll records, biometric logs, and customer PII never leave sovereign Indian jurisdiction without explicit contractual authorization.
• Certified Infrastructure: Data center partners maintain ISO/IEC 27001, SOC 2 Type II, and PCI-DSS Level 1 physical and operational security certifications.

2 Cryptographic Encryption Standards

We enforce defense-in-depth cryptographic protections across every tier of our stack:

3 Strict Isolation & Privacy for Voter Management (VMS) & Civic SaaS

Because AH&V Software engineers high-sensitivity governance tools such as the Voter Management System (VMS) and Desire Management System (DMS), we implement rigorous electoral data privacy protocols:

• Strict Multi-Tenant Database Separation: Constituency voter data, polling station assignments, and volunteer rolls reside in dedicated, isolated tenant schemas with zero cross-tenant query visibility.
• No Third-Party Data Sharing or Pooling: Voter information is NEVER cross-referenced, merged, sold, or shared across campaigns or political entities. Each client maintains 100% exclusive data ownership.
• Cryptographic Hashing of PII: Citizen mobile numbers and identification numbers are stored with one-way salted hashes where direct lookup is not mandatory.
• Automated Campaign Post-Election Purge: Upon campaign conclusion, client data is either exported in encrypted format to the campaign leadership or securely shredded in accordance with Department of Defense (DoD 5220.22-M) data erasure standards.

4 Compliance with DPDP Act 2023 Principles

AH&V Software adheres strictly to the core tenets of the Digital Personal Data Protection Act, 2023:

5 Access Control, 2FA & Device Hardening

• Role-Based Access Control (RBAC): Administrative operations in all client systems are strictly scoped by role permissions (Admin, Department Lead, Staff, Read-Only Auditor).
• Single-Device Biometric Binding: Staff mobile applications (TeamOS) enforce single-device UUID binding with geofence validation to prevent unauthorized session hijacking.
• Audit Logging: Every record mutation, login attempt, payslip generation, and data export is immutably logged with timestamp, user ID, and IP address for forensic compliance.