Enterprise Trust & Sovereignty

Sovereign Security Architected for Zero Compromise

Enterprise AI requires verifiable security boundaries. Xarwiz combines Indian cloud data residency, authenticated AES-256 encryption, database row-level security, and DPDP statutory alignment.

View 35-Clause Security Policy DPDP Privacy Notice

100%Indian Data Residency

AES-256GCM Encryption at Rest

RLSPostgreSQL Tenant Isolation

DPDPStatutory Safeguards Ready

Defense in Depth

Architectural Security Safeguards

A multi-layered defense model designed to protect enterprise data across compute, storage, and networking.

Indian Sovereign Cloud Residency

All databases, document chunks, vector embeddings, and execution logs reside exclusively within tier-3/4 data centers in India. No customer payload is routed to foreign jurisdictions.

100% data localization in Indian regions
Zero cross-border data transfer
Dedicated VPC peering options for enterprise

Cryptographic Encryption

Document content chunks in pgvector and disk caches are encrypted using AES-256-GCM authenticated cipher with tenant master key derivation. Data in transit uses TLS 1.3 exclusively.

AES-256-GCM encryption at rest
Enforced TLS 1.3 with forward secrecy
Automated cryptographic secret rotation

PostgreSQL Row-Level Security (RLS)

Multi-tenant isolation is enforced at the database engine level. Every SQL statement is scoped by tenant_id, preventing accidental cross-tenant data leakage or SQL injection bypass.

Hard schema and row isolation
Dedicated vector search namespaces
Role-based access control (RBAC)

Sandboxed Agent Tool Containment

Autonomous AI agents executing bash commands, file manipulation, or code generation run inside non-root child process sandboxes with strict timeouts and path traversal prevention.

Workspace directory confinement
Command execution timeouts (30s)
Non-root process privilege limits

Statutory Data Protection

Aligned with the Digital Personal Data Protection Act 2023

As an Indian technology company, Xarwiz is architected in alignment with the statutory obligations of the DPDP Act 2023. We empower enterprise fiduciaries to maintain compliance with zero engineering friction.

Purpose-Specific Consent Logging: Explicit consent records and privacy notice versioning stored with immutable timestamps.

Data Principal Rights Portal: Self-service mechanism for citizens to access, correct, or erase their indexed personal data.

Statutory Grievance Redressal: Designated Data Protection and Grievance Officer reachable with statutory response timeframes.

DPDP Privacy Notice Contact Privacy Team