Security overview

Hosting and data location

• Database and files: Supabase, Mumbai (India). Application, jobs and voice gateway: our server in India.
• Optional India-only processing for AI and speech. Sub-processors and their locations are on the Subprocessors page.

Access control

• Every table is protected by row-level security: one business can never read another's rows. Automated tests check this for every table and role on each release.
• Roles and permissions per login, seat limits, single sign-on (SAML / OIDC) and two-step verification options, session lists with remote sign-out, password minimum length 12 with breached-password checks.
• Origin Pixel staff can open a client's data only through a time-limited support session that is logged and visible to the client.

Encryption and secrets

• TLS for all traffic; encryption at rest by the database provider; encrypted backups.
• Connector passwords, API keys and OAuth tokens are encrypted with AES-256-GCM using keys held only on our server; tokens and links are stored as hashes. Sensitive fields (contacts, transcripts, ids) can be field-encrypted per business with key rotation.
• Aadhaar numbers are masked; full numbers are never sent to AI providers.

Monitoring, logging and incidents

• Append-only, hash-chained audit log of sensitive actions; structured logs with request ids kept 365 days in India; clocks synced to NIC / NPL time servers.
• Uptime and error monitoring with alerts; public status page.
• Incident response with targets: CERT-In within 6 hours, affected clients within 24 hours, regulators within the legal deadlines.

Application security

• Built to OWASP ASVS Level 2, OWASP Top 10 / API Top 10 / LLM Top 10: input validation, CSRF protection, strict content security policy, rate limits, idempotency keys, signed webhooks, SSRF-safe outbound requests, upload checks with malware scanning.
• AI safeguards: prompt-injection defences, approvals for sensitive AI actions, no training on client data, AI disclosure that cannot be switched off.

Resilience

Nightly encrypted backups (14 daily, 8 weekly) with weekly automated restore checks, documented disaster recovery, provider failover for AI, speech and telephony.

Certifications and reports

We do not hold SOC 2, ISO 27001 or similar certifications today. We answer security questionnaires for clients once a year and on request, and we are working towards ISO 27001 readiness. [Update when certified.]

Report a vulnerability

See Security and responsible disclosure (security@originpixel.in, safe harbour, response targets).