Security and trust
Your company's data, protected by design.
Payroll, bank, tax and identity records need more than a password. This page describes how Thoshika stores, isolates and controls access to them.
Where your data lives
Thoshika is built and operated for Indian companies, and your data stays in India.
Data in India
Company data, documents and backups are stored in data centres in India. Transactional email is sent through an India region.
Isolated by company
Every table carries a company identifier enforced by PostgreSQL row-level security, so one company's data cannot be read in another's session even if application code has a bug.
Backups and recovery
Databases are backed up automatically. Schema changes are versioned migrations, reviewed and applied the same way in every environment.
Encryption
Data is protected on the network and on disk.
In transit
All traffic between your browser or phone and Thoshika is encrypted with TLS.
At rest
Databases, file storage and backups are encrypted at rest.
Sensitive fields
Sensitive fields such as bank account numbers are masked in the interface and in the audit trail. Aadhaar is stored masked only.
Access control
People see only what their role and scope allow.
Role-based access (RBAC)
Each app has its own roles. A role can be limited to a location, legal entity, GSTIN, branch, territory or team, and every API call is checked against it.
Passkeys
Sign in with a fingerprint, face or device PIN using passkeys (WebAuthn). Passwords remain available; passkeys cannot be phished.
Sangam meetings
Thoshika Sangam calls run on media servers we operate, with waiting rooms, passcodes and optional end-to-end encryption for meetings.
Sessions you control
People can see every device they are signed in on and sign any of them out. Tokens are short-lived and issued per company.
Single sign-on (roadmap)
SAML and OpenID Connect single sign-on with your identity provider, and SCIM user provisioning, are on the roadmap.
Privacy and the DPDP Act
Thoshika is designed for India's Digital Personal Data Protection Act, 2023.
Consent and notices
Consent records with purpose and timestamp, and notices that employees, candidates and customers can review.
Rights requests
Access, correction and erasure requests from data principals are tracked to completion.
Breach register
A register to record, assess and report personal-data breaches.
Audit trail
Changes to business records are logged field by field with who made them and when.
Certifications
Questions from your security team?
Write to [email protected]. To report a vulnerability, use the same address.