Built to pass a vendor review
Every claim below is either live today or explicitly marked roadmap — nothing in between.
Technical measures
What's actually built, not just promised
India hosting
Built for Supabase (ap-south-1) and Railway Mumbai.
Encryption
AES-256 at rest, TLS 1.2+ in transit.
RBAC & field-level permissions
Role × data-scope model — who can act, and which leads they can see.
Immutable audit log
Every mutating action logged with actor, entity, and diff — exportable.
Two-factor authentication
TOTP-based 2FA, self-service setup.
SSO
Google / Microsoft OAuth login.
Backups
Automated database backups with a defined retention policy.
DPDP-ready
Consent capture on every form, DND checks before calls/SMS, right-to-erasure job.
Certification roadmap
Where we stand today
| Certification | Status |
|---|---|
| ISO 27001 | Not started |
| DPDP compliance audit | Not started |
| CERT-In empanelled VAPT | Not started |
| SOC 2 Type II | Not started |
We'll update this table the moment any of these actually starts — not before.
Responsible disclosure
Found a security issue? Email security@isales.in with details and, if you can, steps to reproduce. We aim to acknowledge reports within 2 business days and will keep you updated as we investigate — please don't publicly disclose until we've had a chance to fix it.
Sub-processors
| Provider | Purpose |
|---|---|
| Anthropic | AI call summaries, scoring rationale, and the conversational assistant — only when ANTHROPIC_API_KEY is configured. |
| Razorpay | Payment link creation and webhook-verified payment confirmation — only when Razorpay keys are configured. |
Have a security questionnaire?
Send it over — we'll fill it out honestly, gaps included.