Security
KaryaDocs holds client-identity documents — passports, PAN, and similar. Here is what actually protects them, stated plainly rather than left to a sales call.
Tenant data isolation
Your data is isolated at the database level, not just by a login check. Every business's records are structurally separated, so one business's data cannot reference another's — it is a property of the schema, not a check that can be forgotten in one screen.
Encryption in transit and at rest
Documents and stored access tokens are encrypted both in transit and at rest.
Malware scanning on every upload
Every file is scanned before it is stored or made downloadable — including files that arrive through the no-login client upload link.
Full access audit trail
Every document view and download is logged. The same mechanism logs when our own support staff access a tenant's data during impersonation — with a visible banner shown to your team when that happens.
India's DPDP Act
KaryaDocs is built with the DPDP Act 2023's principles in mind — retention and purge controls, and export and deletion on request. A full compliance statement is pending legal review and will be published here once that review is complete; nothing on this page should be read as a legal compliance claim ahead of that.
What we don't do yet
Two things a security-conscious prospect would reasonably ask about, answered directly rather than left for a sales call:
- No OTP-gated upload links yet.
- No client portal login yet — the upload link is the only client-facing entry point.
Both are on the roadmap. In the meantime, the compensating controls already in place: the public upload page is write-mostly, links are scoped to a single request, and they expire quickly.