DPDP Act 2023 & GDPR Compliance

Privacy Policy

Last Updated: June 3, 2026 • MSME Reg. UDYAM-AP-21-0044317

Core Principle: Zero data monetizing, zero unauthorized retention, zero third-party disclosure. All test evidence is encrypted at rest with AES-256 and purged according to NIST SP 800-88 standards.

1. Scope of Agreement & Engagement Data

TrustLayerLabs is committed to protecting the confidentiality, integrity, and privacy of client environments, architectural configurations, source code excerpts, and customer assets. We execute legally binding bilateral Non-Disclosure Agreements (NDAs) prior to accessing any API schemas, test environments, or staging credentials.

2. Information We Collect & Process

We collect only the minimum information necessary to scope, execute, and deliver security reviews. This includes contact details (name, corporate email, phone), target domain and endpoint specifications, technical documentation (OpenAPI/Swagger specs), and ephemeral test traffic generated during active testing. We never collect or retain customer production passwords or unmasked payment data.

3. Technical Data Security & Encryption

All engagement deliverables, vulnerability proof-of-concept recordings, intercept logs, and threat models are encrypted in transit (TLS 1.3) and at rest using AES-256 encrypted vaults. Access to engagement data is restricted solely to assigned lead offensive practitioners with enforced hardware MFA and strict role-based access control.

4. Retention & NIST-Compliant Data Purging

Following the conclusion of an assessment and completion of the 30-day retesting window, all temporary staging credentials, authentication tokens, and raw traffic logs are permanently wiped according to NIST SP 800-88 guidelines. Final encrypted PDF reports are archived for 90 days to support external auditor inquiries before automated destruction.

5. Data Subject Rights (DPDP Act 2023 & GDPR)

In compliance with India's Digital Personal Data Protection (DPDP) Act 2023 and the General Data Protection Regulation (GDPR), clients have the right to request access to, correction of, or immediate erasure of any personal or corporate information held by TrustLayerLabs. To exercise these rights, contact our Data Protection Officer at privacy@trustlayerlabs.co.in.

6. Third-Party Sharing & Marketing Restrictions

We never sell, rent, or trade client information to third parties. Vulnerability findings, company identities, and infrastructure details are never cited in public marketing, case studies, or blogs without explicit prior written authorization.