Security

What we do today, and what is on the roadmap.

We separate the security controls that are live in production from the ones we plan to add. We do not claim certifications we have not been awarded.

In place today

  • The database and uploaded documents are stored on a server in Mumbai, India, rented from Hostinger.
  • Uploaded and generated documents are encrypted on disk with Fernet (AES-128 in CBC mode with an HMAC-SHA256 tag). The key is held outside the backups and escrowed separately.
  • Nightly backups of the database and uploaded documents are deleted from that server within 16 days of being made. The backups on the server are not separately encrypted. An encrypted copy is kept in Amazon Web Services (AWS) S3 in the Mumbai region (ap-south-1), where S3 encrypts it with keys it manages (SSE-S3); it expires after 35 days and is removed permanently 7 days after that. Copies made before a software deployment or kept for recovery from an incident are outside that schedule and may be retained longer.
  • Data in transit is encrypted using TLS 1.2 or higher.
  • Role-based access control (Admin, Edit, View) on every workspace surface.
  • Every create, update, delete and export is written to an audit log with the acting user and timestamp.
  • Workspace isolation is enforced in the application layer: every query is scoped to the workspaces a user belongs to.
  • Company search returns only companies that appear in the MCA company master data published by the government. A company found only on a third-party website is not shown.
  • Security disclosure mailbox: security@hyperfiling.com.

On the roadmap

  • Database-layer isolation: Postgres Row-Level Security policies are written and will be enforced once the application connects with a non-superuser role. Isolation today rests on application-layer query scoping.
  • Tamper-evident audit log with a defined retention period.
  • SOC 2 Type II audit (target window: late 2026).
  • ISO 27001 information security management certification (target window: 2027).
  • Customer-managed encryption keys.
  • SAML / OIDC single sign-on.

AI processing

Where AI processing happens.

Which model or service handles each kind of request, and where it runs.

Local model first
Text the service generates with a language model, including research answers, drafts and the analysis of uploaded documents and notices, is generated first by a local language model, Gemma 4 (31B), which runs on computing hardware we operate in Karnataka, India. Our server reaches it over an encrypted SSH tunnel.
Cloud fallback
If the local model cannot be reached, times out, returns an error or no answer, or has just failed several times in a row, the request is sent instead to the Claude Sonnet 4.5 model on AWS Bedrock. The request enters AWS in the Mumbai region (ap-south-1), but it uses a global cross-region inference profile, so AWS may process it in another region, inside or outside India.
Search embeddings
To find relevant passages, the text of a research question or search is converted into an embedding by the Amazon Titan Text Embeddings V2 model on AWS Bedrock, in the Mumbai region (ap-south-1). The local model is not used for this step.
Images
Text in an uploaded image (PNG, JPG, TIFF or BMP) is read by the Claude Sonnet 4.5 model on AWS Bedrock through the same global inference profile, so an image may be processed outside India. The local model is not used for images. Our check on image uploads looks only at the AWS region the request enters, which is Mumbai; it does not limit where AWS processes the image. Text in PDF, Word, Excel and CSV files, including scanned PDFs, is extracted on our own server.
Company search
A company name or CIN typed into company search is looked up first in our copy of the government's MCA company master data and, if it is not found there, on the Government of India's open government data platform. If neither finds the company, the text typed may be sent to the DuckDuckGo search engine and, if that fails or finds nothing, to Bing, restricted to three company-directory websites, to find the company's CIN.
Research questions
The text of a research question is not sent to any search engine.

Disclosure

Found a vulnerability?

Email security@hyperfiling.com with reproduction steps. We acknowledge within two working days. Coordinated disclosure is welcome. We will not pursue good-faith researchers who follow the disclosure policy.