What we have, and what we don't
Certification status, data residency and the documents your legal team will ask for — in one place, with the gaps named rather than buried. We would rather lose a deal to an honest answer than win one and be found out in diligence.
Certification status
In place
- In place
DPDP-native product design
India's DPDP obligations are first-class modules, not a GDPR tool retrofitted for India.
- In place
Indian OEM and IP
Built and owned by Alyssum Global Services Pvt. Ltd., an India-incorporated product company.
- In place
Air-gapped / on-premise deployment
Runs with zero outbound traffic. Demonstrable live — we will pull the network cable for you.
- In place
Data residency in India
Self-hosted and in-India by architecture. In sovereign mode there is no cross-border processing and no foreign sub-processor in the data path.
In progress
- In progress
Class-I Local Supplier
Public-procurement classification under the Make in India order. Certification under way.
- In progress
CERT-In empanelled VAPT
Vulnerability assessment and penetration testing by a CERT-In empanelled auditor.
On roadmap
- On roadmap
ISO 27001
Information security management certification.
- On roadmap
SOC 2 Type II
Independent attestation over security and availability controls.
No dates are shown against items that are not yet certified, because there is nothing to date. Ask us during diligence and we will share current evidence and tell you plainly what is missing.
Documents
The agreements and policies that govern how we handle data.
Reporting a security issue
If you believe you have found a vulnerability, write to privacy@dpflo.com with enough detail to reproduce it. We will acknowledge and keep you updated while we investigate, and we will not pursue action against good-faith research.
Still have questions?
Bring your security questionnaire to the first call rather than the end of a procurement cycle.