VinfraSec Ephor security and data residency
Where Ephor keeps your data, how its AI is fenced in, and what stops anyone, VinfraSec included, from quietly changing the record.
Page updated · describes Ephor 0.2.5
In short
Ephor runs only in AWS Mumbai, with disaster recovery in Hyderabad. Its AI runs only on Amazon Bedrock's India profiles, and Aadhaar, PAN, mobile, email and card numbers are masked before any prompt leaves the application. Every user signs in with MFA, every agent output waits for a named person, and evidence is stored write-once in a hash chain, so an edited or deleted record is detected.
- Hosted in
- AWS Mumbai (ap-south-1), disaster recovery in Hyderabad (ap-south-2)
- AI runs on
- Amazon Bedrock India profiles only
- Before AI
- Aadhaar, PAN, mobile, email and card numbers masked
- Sign-in
- Amazon Cognito in Mumbai, MFA for every user
- Records
- Write-once storage and SHA-256 hash chains
- Logs kept
- At least 365 days, in India
- ISO 27001
- Not certified yet; planned
Your data stays in India
- Every Ephor resource runs in AWS Mumbai (ap-south-1), with disaster-recovery copies only in Hyderabad (ap-south-2). The infrastructure code refuses any other region.
- No CloudFront or other global edge service: ephor.vinfrasec.in ends at a load balancer in Mumbai, where TLS terminates.
- An explicit IAM deny blocks any AWS call outside India from every Ephor workload.
- Database backups, kept for 35 days, and evidence are replicated to Hyderabad only.
- Sign-in runs on Amazon Cognito in Mumbai, and the production app refuses a user pool outside India.
- The production app refuses to start with a non-India region or model, development sign-in, local storage or masking turned off.
AI that stays in India and doesn't see identifiers
- Only Amazon Bedrock's India geographic profiles are allowed, and AWS routes them only between Mumbai and Hyderabad. The app and IAM both reject any other model.
- One model gateway is the only path to a model. Before a prompt leaves the application it swaps Aadhaar (including Virtual ID), PAN, Indian mobile, email and card numbers for single-use tokens, and puts them back afterwards.
- Ephor keeps hashes of prompts, not the prompts. Bedrock's own invocation logs keep metadata only.
- Every agent action is logged with the model, region, prompt version, input and output hashes and the number of identifiers masked.
- Machine translation of privacy notices, when switched on, runs on an open model (IndicTrans2) in Ephor's own endpoint in Mumbai and never logs the text it translates.
- If the model is unreachable or its output fails validation, the agent falls back to a rule-based draft and says so.
Who can sign in, and what each role can do
Admin
Manages members, AWS connectors and consent sources.
Approver
Approves or edits drafts, publishes notices, records filings, accepts risks, stands down clocks and confirms that processing stopped.
Analyst
Reads and reviews, opens incidents and rights requests, and starts agent drafts. Can't approve or file.
- Every user signs in with MFA, with Cognito threat protection enforced and no self sign-up: an admin adds each user.
- Each organisation is a separate tenant. Every record carries its tenant, every query is scoped to it, and membership is checked on each request.
- A tenant can't be left without an admin.
Records nobody can quietly change
- Evidence is stored write-once under S3 Object Lock and encrypted with a customer-managed KMS key.
- The audit log and the evidence locker are hash chains per organisation, with SHA-256 over every stored field.
- Every 5 minutes, and after every regulator filing, Ephor writes the head of each chain to write-once storage. Deleting the newest entries, editing an old one or overwriting an anchor is detected.
- Downloads are re-hashed before they're served, and the whole locker can be re-verified on demand.
- If a check fails, Ephor records an integrity-failure event and alerts VinfraSec's desk.
- Approvals, filings and stand-downs lock the record, so two approvers can't overwrite each other.
Encryption, logging and monitoring
- Customer-managed KMS keys on the database, storage, queues, notifications, secrets and logs.
- TLS 1.2 or later in transit, and verified TLS to the database.
- Logs are kept for at least 365 days in India and encrypted with KMS. CloudTrail delivers to a Mumbai bucket under Object Lock, with log-file validation.
- GuardDuty threat detection, AWS Config and AWS WAF run on the platform, and alarms go to VinfraSec's desk.
- Request sizes are capped, database parameters and error details never reach the logs, and container dependencies are installed against pinned hashes.
Connecting your AWS account
- You deploy a read-only IAM role with a Terraform module VinfraSec provides, tied to an external ID issued in the Ephor console.
- The role reads configuration metadata for the 19 readiness checks and explicitly denies reading your data.
- Scans run from Mumbai through the regional STS endpoint.
Consent events from outside
- Each consent source signs every event with its own Ed25519 key. Ephor stores only public keys and refuses weak ones.
- The signature covers the source ID, so an event meant for one organisation can't be replayed into another.
- Events with a timestamp more than 5 minutes off, or larger than 16 KB, are refused. Refusals are counted on the source instead of written to your audit log, so junk traffic can't flood it.
- An event whose identifiers contain a phone number, email, Aadhaar, PAN or card number is refused. A withdrawal is the exception: it is recorded with the reference withheld, so the stop still happens.
People decide; agents draft
- Agents can only create drafts. Approving, filing, accepting a risk, standing down a clock, attesting a control, publishing a notice, closing incidents or requests, and confirming that processing stopped are human-only and checked by role.
- Ephor never submits anything to CERT-In, the Data Protection Board or a Data Principal. A person files and records the reference.
- Desk training uses synthetic training tenants that run the same code paths, never customer data.
How Ephor is reviewed and tested
Each major part of Ephor went through a security and compliance review before release. The reviews were internal and AI-assisted, run by VinfraSec; they were not third-party audits. Every finding was fixed, and all but two of the fixes are covered by automated tests.
| Review | Findings, all fixed | Examples |
|---|---|---|
| Platform core | 3 high, 7 medium | Request bodies capped while they stream in; database parameters and error messages kept out of logs; KMS key policies narrowed |
| DPDP drafting agents | 3 high, 6 medium, 3 low | Record injection through draft text; unvalidated record edits; Indian-script digits not masked |
| Consent ledger | 1 high, 7 medium | A signature not bound to its source, so an event could be replayed into another organisation; weak keys; reused event IDs |
Release 0.2.5 passes 282 backend tests on SQLite and 284 on PostgreSQL 16, and 80 console tests, with no known vulnerable console dependencies. An infrastructure scan (checkov) reports 819 checks passed, 0 failed and 21 documented exceptions.
What isn't done yet
- ISO 27001. VinfraSec isn't certified yet. Certifying the security management system that covers Ephor is planned before the first regulated customer goes live.
- Alert recipients. Clock alerts go to VinfraSec's desk today, and your team sees every clock live in the console. Alerts to your own recipients are on the roadmap.
- Off-boarding. A workflow to export and erase a departing customer's data is on the roadmap. Evidence stays locked for its retention period, 365 days by default, first.
- Availability. Trials and design partners run on a smaller, single-zone setup. Paid customers run on the production setup with a multi-zone database. Both have the same security controls.
Questions buyers ask
Something else? Book a call or see how Ephor works.
Where is VinfraSec Ephor hosted and processed?
Only in India: AWS Mumbai (ap-south-1), with disaster recovery in Hyderabad (ap-south-2). There's no CloudFront, IAM denies any AWS call outside India, and AI inference runs only on Amazon Bedrock's India profiles.
Does Ephor send personal data to the AI model?
Ephor masks Aadhaar (including Virtual ID), PAN, Indian mobile, email and card numbers with single-use tokens before any prompt leaves the application, and restores them afterwards. The model runs on Amazon Bedrock's India profiles, Ephor keeps hashes of prompts rather than the prompts, and masking can't be switched off in production. Ephor can't recognise names, so keep names and contact details out of free-text notes.
Can anyone edit or delete evidence in Ephor?
Evidence is written once under S3 Object Lock and chained with SHA-256 hashes per organisation. The head of each chain is anchored to write-once storage every 5 minutes and after each filing, so an edited, deleted or truncated record is detected and VinfraSec's desk is alerted.
What access does Ephor need to our AWS account?
A read-only IAM role that you deploy with a Terraform module VinfraSec provides, tied to an external ID from the Ephor console. The role reads configuration metadata for the 19 readiness checks and explicitly denies reading your data.
Is Ephor ISO 27001 certified?
Not yet. VinfraSec plans to certify the security management system that covers Ephor before the first regulated customer goes live. Until then, this page describes the controls in place and how they were reviewed.
Who reviewed Ephor's security?
VinfraSec ran internal, AI-assisted security and compliance reviews of the platform core, the DPDP drafting agents and the consent ledger. They found 7 high, 20 medium and 3 low-severity issues. All were fixed, and all but two of the fixes have automated tests. These were not third-party audits.
Start with a free readiness scan
We'll run Ephor's 19 read-only checks against one of your AWS accounts and walk you through the gaps against CERT-In and DPDP.