Security Policy

This policy is maintained to meet section 43A of the Information Technology Act, 2000 and rule 8 of the SPDI Rules, 2011 (which recognises an information security programme with documented policies), section 8(5) of the Digital Personal Data Protection Act, 2023 and the security safeguards in the DPDP Rules, 2025 as they come into force, and the CERT-In Directions of 28 April 2022. Our controls are informed by ISO/IEC 27001. Vaani AI does not currently hold an ISO/IEC 27001 or SOC 2 certification.

• The directors own this policy and approve changes. The Grievance Officer is the contact for security and privacy matters.
• Access to production systems is limited to personnel who need it to operate the Service, who are bound by confidentiality obligations.
• Secrets such as API keys and database passwords are kept in server environment configuration, never in source code or in browser-visible settings.

• Application servers, database and file storage run on a dedicated virtual server operated by Hetzner Online GmbH in Finland (EU). The website is served by Vercel.
• Services run in isolated containers on a private network; only the web proxy is exposed to the internet.
• The host firewall denies all inbound traffic except web and administrative SSH access, and repeated failed SSH logins are blocked automatically (fail2ban).
• Operating system and dependency updates are applied as part of regular maintenance.

• All traffic to the website and API uses HTTPS with TLS certificates issued by Let's Encrypt and renewed automatically.
• HTTP Strict Transport Security (HSTS) instructs browsers to use HTTPS only, for one year.
• Connections to our service providers (transcription, AI, payments, email) use encrypted HTTPS or TLS connections.

• Customer data is separated by organisation: every request is checked against the signed-in user's organisation before data is returned.
• Passwords are never stored; only salted one-way hashes (bcrypt, cost factor 12) are kept.
• Where an organisation selects Amazon S3 storage, files are stored with server-side encryption (AES-256).
• Card, UPI and bank details are entered on Razorpay's checkout and are not stored by Vaani AI.

• Sign-in uses email and password or Google sign-in. Sessions use signed tokens that expire after 7 days.
• After five failed sign-in attempts an account is locked for 15 minutes; sign-in and password-reset endpoints are rate-limited.
• Role-based access control separates members, organisation administrators and platform administrators. Administrative pages are protected on the server and are not indexed by search engines.
• Browser-extension sessions can be revoked by signing out of the extension.
• Administrative actions are recorded in an audit log.

• Security headers on every response, including a Content Security Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
• Rate limits on the API, uploads, AI processing, webhooks and the public contact form.
• Input sanitisation that strips null bytes and blocks prototype-pollution keys; validation of request fields.
• Uploaded files are checked against an allow-list of types, renamed, and rejected if they contain executable code signatures.
• Error messages returned in production do not expose internal details.
• Changes are tested before deployment, and deployment runs automated type and syntax checks.

Application, access and security logs are retained for at least 180 days, with system clocks synchronised to standard time sources, as required by the CERT-In Directions, and are made available to CERT-In on request. Logs are reviewed when investigating issues or suspected incidents.

The production database is backed up automatically every day. Fourteen daily and four weekly copies are kept and older copies are overwritten. A backup is also taken before each deployment. Recovery procedures are documented.

We use established providers for hosting, transcription, AI and payments, and share only the data each needs. The current list is:

Details, including data shared and retention by providers, are in the Privacy Policy.

• Detect and contain: isolate affected systems, preserve logs and evidence.
• Report: notify CERT-In of reportable cyber security incidents within six hours of becoming aware; once the relevant DPDP Rules apply, notify the Data Protection Board of India and affected individuals as they prescribe; notify affected business customers without undue delay.
• Recover: restore service from clean systems and backups, rotate affected credentials.
• Review: record the root cause and corrective actions, and update this policy where needed.

If you believe you have found a security vulnerability, email support@vaaniai.com with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosure, do not access or modify other users’ data, and do not run tests that degrade the Service. We will acknowledge your report within 48 hours and will not pursue action against good-faith research that follows these rules.

• Use strong, unique passwords and keep them confidential.
• Grant administrator roles only to people who need them, and remove users who leave your organisation.
• Tell participants before recording, and record only what you are entitled to record.
• Report suspected unauthorised access to support@vaaniai.com immediately.

This policy is reviewed at least once a year and after any significant change or incident. Contact for security matters: