Built for Indian Enterprise Scale. Verified for Total Statutory Trust.

Digital Personal Data Protection Act, 2023

Statutory Scope: Sections 2(i), 2(k), 6, 8, 11–16

We enforce strict Fiduciary/Processor alignment. Notice and explicit consent are captured prior to AI conversational processing. Section 16 cross-border transfer compliance is guaranteed via sovereign AWS Singapore database pooling.

Information Technology Act & SPDI Rules 2011

Statutory Scope: Rules 3, 4, 5, & 6 (Sensitive Personal Data)

All Sensitive Personal Data or Information (`SPDI`) including financial records and credentials are encrypted at rest via AES-256-GCM (`SECRETS_ENCRYPTION_KEY`) and in transit via strictly TLS 1.3.

MeitY IT Amendment Rules 2026 (SGI Mandate)

Statutory Scope: Rule 3(2)(b) Emergency Takedown & SLAs

We maintain 2-hour / 3-hour response window SLAs for Significant Government Information (`SGI`) requests and emergency takedown orders issued by CERT-In or statutory courts.

Central Goods and Services Tax Rules (`SAC 998314`)

Statutory Scope: Rule 46 & NIC IRP E-Invoicing

All B2B SaaS subscription billing and AI token usage fees are accounted under SAC 998314 with 18% GST. Built-in NIC IRP integration validates schemas to generate 64-character Invoice Reference Numbers (`IRN`).

Companies (Accounts) Rules, 2014 Rule 3(1)

Statutory Scope: Immutable Audit Ledgers & Edit Logs

Every database mutation (`INSERT, UPDATE, DELETE`) across financial and ledger tables is logged immutably in `audit_logs` and `record_locks` with cryptographic checksums and retained for 8 financial years.

RBI Data Localization & Cross-Border Mandate

Statutory Scope: Storage Isolation & Sub-100ms Latency

All primary database volumes and active customer ledgers reside securely inside AWS Asia Pacific 1 (`ap-southeast-1` Singapore pooler), guaranteeing sub-100ms network latency (~45ms to Morbi/Rajkot).

Information Security Management System (`ISMS`)

Hardware-enforced Row-Level Security (`FORCE RLS`) on 100% of multi-tenant tables. Non-superuser application runtime role (`operaai_app`) with zero `BYPASSRLS` privileges.

Privacy Information Management System (`PIMS`)

PII redaction and token sanitization across all Sentry observability pipelines (`Sentry PII scrubber`). Automated data minimization and right-to-erasure execution paths.

Cloud Security & Public Cloud PII Protection

Strict virtual resource isolation using transactional savepoint encapsulation. Directory traversal attacks (`..`) and cross-tenant file reads are blocked at the storage gateway.

Quality Management System (`QMS Modularity`)

Strict `< 450 lines of code per file` engineering ceiling. Verified continuously via 0 compilation errors (`npx tsc --noEmit`), 0 lint errors, and 64/64 green Vitest suites.

Business Continuity & Disaster Recovery (`BCMS`)

Vercel Pro high-frequency cron infrastructure (`300s maxDuration`) combined with global process socket drop guards (`__operaAiDbProcessGuard` in `lib/db.ts`) ensuring 99.9% uptime.

Trust Services Criteria & Payment Security v4.0

Separation of duty (`Owner vs Runtime roles`). Cash-first Indian offline payment separation (`payment_settings`) ensuring zero raw credit card PAN storage on application servers.