Security

Care data is private by default.

How we verify agencies and carers, encrypt your data, secure payments, and respond when things go wrong. Aligned with India's Digital Personal Data Protection Act.

Trust & safetyPrivacy policy

The pillars

What's working in the background

No single control is enough. We layer six categories of protection around your data — and review every one quarterly.

  • Verified agencies and nurses

    Every listing is a registered legal entity, address-verified at onboarding and re-verified annually. Independent nurses additionally provide council registration and qualification documents.

  • KYC carers

    Government ID and police-record check on every carer in the field. Documents stored encrypted and audited; verification re-run on a fixed cadence.

  • Encrypted at rest and in transit

    Phone numbers, addresses, medical conditions and payment metadata are encrypted in our database. TLS 1.2+ everywhere, terminated at AWS CloudFront with ACM certificates.

  • Hosted in India

    Your data lives in AWS Mumbai (ap-south-1) by default. We do not transfer personal data outside India except where strictly required and only under DPDP-compliant safeguards.

  • Payments via Cashfree

    PCI-scope reduced to SAQ A — card data never touches our servers. Webhook signatures verified with replay protection. Hourly settlement reconciliation.

  • Audited access

    Every booking-state change, payment event, login, and admin action is audit-logged with user, IP, and timestamp. RBAC enforced server-side; cross-tenant attempts alerted.

Three things we promise

The non-negotiables

  • Aadhaar OKYC for high-risk bookings

    Independent-nurse and ICU-at-home bookings require Aadhaar verification via Surepass before they can be confirmed. Aadhaar number is masked in our database — we store only the verification result.

  • Phone OTP, not passwords, for families

    Family accounts are phone-verified only. Rate-limited per phone and per IP, with bot protection and a tarpit on the lookup endpoint to prevent enumeration.

  • DPDP-aligned

    Three separate consents at booking (service delivery, marketing, agency-sharing). Right-to-erasure handler honoured within 30 days. Logs scrub PII (+91XXXXXX1234).

If something goes wrong

How we respond to incidents

We treat any unauthorised access to personal data as a P0 incident — page rotation, on-call security lead, and the four steps on the right.

  1. Triage within 2 business days

    Our security team confirms receipt and starts containment.

  2. Notify regulators within 72 hours (if required)

    DPDP requires notification to the Data Protection Board within 72 hours of becoming aware of a personal-data breach.

  3. Notify affected users

    Direct notification (email + SMS) to anyone whose data was affected, with what we know and what we're doing.

  4. Post-incident review

    Public timeline + lessons learned within 30 days of resolution.

Security researchers

Responsible disclosure programme

Found a vulnerability? Tell us — we won't take legal action against good-faith research that follows our scope and gives us reasonable time to fix.

  • Triage within 2 business days
  • Critical fixes within 7 days
  • Hall of fame for valid reports; bug-bounty programme post-launch
security@aayulcareu.com

For families

Read the trust & safety promise.

Verification, KYC, refunds, dispute mediation — what you can expect from every booking.

Trust & safety

For agencies

See the platform-side controls.

Audit log, RBAC, KYC re-verification, compliance reports — the agency-side trust layer.

For agencies