Your data stays in India
All your data is stored on servers in India. We follow Indian data residency requirements under the DPDPA 2023. Your donor information never leaves the country.
FCRA funds are tracked separately
Foreign donations are automatically kept separate from Indian donations, as required by FCRA. You don't need to manage this manually. If you're ever audited, the records are already clean.
Every team member sees only what they need to
Assign different roles to your finance team, programme managers, and volunteers. Each role controls which sections and features a team member can access.
Donor data is encrypted
Sensitive donor information (PAN numbers, bank details, contact information) is encrypted at rest and in transit. Payments go through Razorpay. We never see or store card numbers.
Daily backups
Your data is backed up every night. If anything ever goes wrong, nothing is lost. Live status of every production component is published on our status page - we don't advertise an uptime SLA we can't back with probe history.
Built for Indian regulatory requirements.
Where we stand today
The compliance ground truth.
-
DPDPA 2023 Compliant
Data Fiduciary registration on file. Phase I (data principal rights, breach notification) live; Phase II (consent manager handshake) targeting Nov 2026 with the official DPDP commencement; Phase III (cross-border transfer rules) tracking May 2027.
-
FCRA 2010 Compliant
FCRA-designated bank account routing enforced at validation and model level. FC-3C / FC-6 generated from the donation register; transaction ledger exportable.
-
IT Act 2000 Compliant
Records retention, audit-trail and authentication aligned with the Information Technology Act and CERT-In incident-reporting timelines.
-
Section 80G / 12A Compliant
Receipts generated in the CBDT-prescribed format. Form 10BD / 10BE export ready for annual filing in one click.
We only badge what's already in force. Third-party security attestations are work-in-progress and will appear here once the certificate is issued, not before.
How the platform is built
Isolation, encryption, and recovery.
Every tenant-owned record carries its organisation id, enforced by a shared model layer that scopes every query to the signed-in tenant. Cross-organisation surfaces (funder-to-partner links, funding call applications) name both parties explicitly and are covered by automated cross-tenant tests that assert the other side sees nothing it should not.
PAN and government identifiers, bank and payee account numbers, and two-factor secrets are encrypted at the field level before they reach the database. Payee accounts render masked to the last four digits everywhere except the bank file itself, and never leave through the API. All traffic runs over HTTPS.
Encrypted database and file backups run nightly with monitored freshness. A weekly automated drill restores the latest backup into an ephemeral database and sanity-checks row counts, so a corrupt backup is caught within days, not during an outage.
We keep the list short and current:
- Oris Intelligence Private Limited: AI processing for donor insights and CSR drafting (the ORIS layer).
- Razorpay: payment collection and settlement for donation flows.
- Hosting and CDN infrastructure: application and asset serving for donateazy.in.
Live service health is public on the status page, backed by the machine-readable health endpoint.