This page is written for the person who has to approve the platform before a client can use it. It says what is in place, in plain words, and it says what is not, so you can assess it rather than take it on trust.

Where the data lives

The database is PostgreSQL, hosted in the Mumbai region (ap-south-1). Each environment has its own schema; production and the test environment never share tables.
The application runs on AWS in Mumbai: the site and the reports through CloudFront and S3, the API on Lambda, email through SES.
Everything is encrypted in transit with TLS, and at rest by the hosting providers.

Who can reach it

Every person has a seat on a named workspace with a role: owner, editor, respondent or viewer. A respondent answers and sees nothing else. A viewer reads what is published to them and changes nothing. Only the owner invites, revokes, sets the brand or changes the plan.
Passwords are never stored in clear; sign in is by password with confirmation by email, and every session can be revoked at once for a person across all their workspaces.
Operator access to a client workspace exists only under a recorded support grant, is shown on every screen while it is in use, and is logged.
Single sign on is not switched on. Sign in is by email and password with confirmation by email. Single sign on with Microsoft, Google or a SAML provider is available on request for a firm licence and is set up per firm; it signs in an address that already holds a seat and never creates one.

How long it is kept

Each workspace has retention periods by category, set by the owner within fixed bounds, and a daily sweep applies them. Records are marked rather than deleted where a person's authorship must survive, for example an answer given by somebody whose seat was later revoked.
A workspace can be exported by its owner and deleted on request. Deletion is confirmed in writing.
Files attached behind an answer (PDF, image, CSV, Excel, Word or PowerPoint, up to 25MB) go to a private, encrypted bucket in Mumbai under the workspace's own prefix. The browser reaches a file only through a link the platform mints for a signed in seat, good for five minutes.

The copy outside the provider

Every night at 02:00 India time a read only copy of the whole database is written to an S3 bucket the application can write to and never read or delete, versioned, encrypted and kept for 35 days. A manifest records every table, its row count and a checksum, and a restore drill script proves a restore puts back exactly what was taken. This is the second copy, the one that survives losing the provider.

The audit trail

Every download of a brief or a deck is stamped with a copy code, printed in the file and recorded with who requested it, so a copy that turns up where it should not points at one download.
Sign ins, seat grants and revocations, plan changes, decisions and their history, evidence requests and their responses are all recorded with who and when.

Email and AI

Email is sent from a verified domain, with an unsubscribe on every note that is not a confirmation or a password reset. Bounces and complaints stop further mail to that address.
Where AI drafting is used, it works from the reading's own content and the draft is shown to the person before anything is saved. Nothing is drafted or sent without a person's action.

What is not yet in place

No SOC 2 or ISO 27001 certification yet. The controls above are listed so your team can assess them directly, and the audit is planned for the first year after the pilot.
No penetration test report yet from a third party. One is planned before the first firm licence.

Subprocessors

Amazon Web Services (hosting, email, backups), Supabase (managed PostgreSQL and sign in), Anthropic (AI drafting, only when used). Payments, when they apply after the pilot, go through Razorpay and no card detail touches the platform.

Questions from a security review go to hello@themodernanalytics.com and are answered by a person, usually the same day.

Security and data on the platform