Privacy Policy

1. Introduction

K3NP Cipherion Pvt. Ltd. ("Cipherion", "we", "us", "our") is a company incorporated under the laws of India. We operate a Unified Data Security Platform that provides field-level encryption, tokenization, anonymization, and cryptographic key management services delivered via APIs, SDKs, and cloud-based infrastructure.

This Privacy Policy describes the personal data we collect when you register and use the Cipherion platform, the purposes and legal bases for which we process it, how we protect and retain it, and the rights available to you under applicable data protection law.

This Policy applies to your use of the Cipherion dashboard, APIs, SDKs, and all associated authentication flows, including sign-in via third-party identity providers. It is incorporated by reference into our Terms and Conditions. By creating an account or using the Service, you confirm that you have read and understood this Policy.

2. Data Controller & Contact

For the purposes of applicable data protection law — including the EU General Data Protection Regulation (GDPR), UK GDPR, and the Digital Personal Data Protection Act, 2023 (DPDP Act) — Cipherion acts as the Data Controller / Data Fiduciary with respect to the personal data of its platform users described in this Policy.

3. Personal Data We Collect

We collect only the minimum personal data necessary to provide, secure, and operate the platform. All data collection is purpose-limited and proportionate to the stated use.

3.1 Account & Identity Information

When you register for a Cipherion account — directly or via a third-party identity provider — we collect basic identity information necessary to create and maintain your account. This includes your name, email address, and, where you choose to provide it, your phone number and company name. A secure, one-way hash of your password is stored if you register with a password; we never store passwords in plaintext.

We also maintain records of your email verification status and your acceptance of our Terms and Conditions, including the version accepted and the date of acceptance, for contractual and compliance purposes.

3.2 Authentication via Third-Party Identity Providers

If you choose to sign in using a supported third-party identity provider such as Google or GitHub, we receive limited profile information from that provider — typically your name, email address, and profile image — and store a secure link between your Cipherion account and your provider identity. We also hold the authentication credentials (such as access and refresh tokens) issued by the provider, which are encrypted at rest and used solely to maintain your authenticated session.

We do not receive or store your Google or GitHub password, and we do not access your files, repositories, contacts, or any resource beyond what is required to authenticate you. You may revoke our access at any time through your provider's security settings.

3.3 Session Information

Each authenticated session generates a secure, unique session token which is stored in hashed form. To support security monitoring and fraud prevention, we also record the IP address and device/browser information (user-agent) associated with each login. Sessions are invalidated and their records removed upon logout or expiry.

3.4 Project & Cryptographic Credential Data

When you create a project on the platform, we store the project name and an optional description. For each project, we maintain the cryptographic credential record needed to operate the encryption service. This includes your API key identifier (displayed in masked form), the encrypted private key material, and the associated cryptographic parameters used in key derivation — all of which are encrypted at rest using AES-256.

Critically, the passphrase that protects your key material is never transmitted to or stored by Cipherion. Cipherion cannot access, read, or decrypt your key material under any circumstances.

3.5 One-Time Passwords & Verification Codes

We generate time-limited, single-use one-time passwords (OTPs) to authorise sensitive operations — including account verification, credential management actions, and two-factor authentication steps. We store a hashed record of each OTP along with its purpose, status, creation timestamp, and, where applicable, the timestamp at which it was used or expired. OTP records are automatically purged within 24 hours of use or expiry.

3.6 API Activity Logs

To support platform security, performance monitoring, and billing, we maintain logs of API requests made through your projects. Each log entry records the type and outcome of the request, timestamps, response characteristics, and network information including the originating IP address and device/browser identifier. IP addresses constitute personal data and are handled accordingly.

Separately, we maintain aggregated, statistical summaries of API usage per project (such as call volumes and latency averages) for billing and reporting purposes. These aggregates do not contain personal data.

3.7 Billing & Payment Records

We maintain records of your subscription plan, billing cycle activity, usage against your plan quota, and invoices issued. We do not collect or store payment card numbers or banking credentials; where payments are processed, this is handled by a PCI-DSS-compliant payment processor operating under its own privacy policy.

4. How We Use Your Personal Data

We process your personal data only for the following documented purposes:

We do not use your personal data for advertising, behavioural profiling, or sale to third parties under any circumstances.

5. Legal Basis for Processing

Where GDPR, UK GDPR, or the DPDP Act, 2023 applies, we rely on the following lawful bases:

• Contract performance (Article 6(1)(b) GDPR / DPDP Act): Processing necessary to deliver the platform services agreed in our Terms and Conditions — including account management, authentication, and encryption service delivery.
• Legitimate interests (Article 6(1)(f) GDPR): Security monitoring, fraud prevention, and platform integrity. We have assessed that these interests do not override your fundamental rights.
• Legal obligation (Article 6(1)(c) GDPR / DPDP Act): Retention of billing records, tax documentation, and compliance audit trails as required under Indian law and applicable international regulations.
• Consent: Where required — for example, for optional contact details used in SMS-based verification — we obtain your explicit consent, which you may withdraw at any time via account settings or by contacting us.

6. Third-Party Identity Providers (Google & GitHub)

Cipherion supports sign-in via Google and GitHub. When you authenticate through these providers, you are directed to the provider's own authentication page and Cipherion does not handle your provider password. Upon successful authorisation, we receive a limited set of profile data and authentication credentials as described in Section 3.2.

Tokens received from providers are encrypted at rest and are used solely to maintain your authenticated session. We do not use them to access any of your data held by the provider.

• You may revoke access at any time through your Google or GitHub account security settings. Revocation will invalidate your active session.
• Google's privacy practices: https://policies.google.com/privacy
• GitHub's privacy practices: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

7. Data Sharing & Sub-Processors

We do not sell, rent, or trade your personal data. Personal data is shared only with the sub-processors listed below, who are contractually bound to process data solely for the purpose of delivering the Service and subject to obligations no less protective than those in this Policy.

The current sub-processor list is maintained at https://www.cipherion.in/sub-processors. We will notify you at least 14 days in advance of any sub-processor changes, giving you the opportunity to object in writing.

We may disclose personal data to law enforcement or regulatory authorities where required by applicable law, and will notify you to the maximum extent permitted by law.

8. Data Retention

9. Data Security

Cipherion implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure, consistent with Article 32 GDPR and the DPDP Act, 2023. Our measures include:

• Encryption at rest — all stored data, including cryptographic credential records, is encrypted using AES-256
• Encryption in transit — all communications between clients and the platform are secured via TLS 1.2 or higher
• Client-Controlled Key Architecture — your passphrase and plaintext key material are never transmitted to or accessible by Cipherion
• Secure credential storage — passwords are stored as secure one-way hashes; third-party authentication tokens are encrypted at rest
• Access controls — role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative access to platform systems
• OTP controls — one-time passwords are single-use, time-limited, and automatically purged after use or expiry
• Audit logging and monitoring — comprehensive logging of platform operations with real-time security alerting
• Regular security assessments — periodic vulnerability assessments and penetration testing
• Staff obligations — all personnel with access to personal data are subject to contractual confidentiality obligations and receive regular data protection training

In the event of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours of first becoming aware, in accordance with our contractual and regulatory obligations.

10. International Data Transfers

Our primary infrastructure and database are located in Mumbai, India. Encrypted backups are stored with approved sub-processors configured to retain data within India and approved EU regions. Authentication flows may transit the globally distributed infrastructure of Google or GitHub.

• EU/EEA and UK clients: Standard Contractual Clauses (SCCs) approved by the European Commission, and UK International Data Transfer Agreements (IDTAs) where applicable, are in place with relevant sub-processors.
• Indian clients (DPDP): Cross-border transfers are conducted in accordance with applicable restrictions under the DPDP Act, 2023.
• All other jurisdictions: We rely on adequacy decisions or appropriate contractual safeguards as applicable to the client's jurisdiction.

11. Your Privacy Rights

Depending on your jurisdiction, you have the following rights with respect to your personal data. To exercise any right, contact us at official@cipherion.in. We will respond to verified requests within 30 days (extendable by a further 60 days for complex requests where permitted by law).

We may require identity verification before processing a request. Due to our Client-Controlled Key Architecture, certain encrypted platform data cannot be retrieved or decrypted by Cipherion; we will explain any such limitations clearly in our response.

12. Cookies & Session Management

The Cipherion dashboard uses strictly necessary session cookies to maintain your authenticated state. These are used solely for authentication and security purposes and are not used to track you across other websites.

We do not deploy third-party analytics cookies, advertising cookies, or tracking pixels. If you sign in via a third-party identity provider, that provider may set its own cookies governed by its privacy policy.

13. Children's Privacy

The Cipherion platform is intended for business and developer use and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, please contact us at official@cipherion.in and we will delete such data without delay.

14. Notice Under the Digital Personal Data Protection Act, 2023 (India)

In compliance with the DPDP Act, 2023, this Policy constitutes the notice to Data Principals of the purposes for which their personal data is processed, as required under Section 5 of the Act.

• Cipherion is the Data Fiduciary for account and platform management data.
• Data Principals may withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing but may affect your ability to use certain features of the Service.
• Grievance redressal: contact official@cipherion.in. We will acknowledge within 48 hours and aim to resolve within 30 days.
• Data Principals may escalate unresolved grievances to the Data Protection Board of India once constituted.

15. Updates to This Policy

We may update this Privacy Policy to reflect changes to our data practices, platform features, or applicable law. When we make material changes, we will post the updated Policy at https://www.cipherion.in/privacy with a revised effective date and notify you by email to your registered address at least 14 days before the change takes effect. Where required by law, we will seek renewed consent.

Your continued use of the Service after the effective date of an updated Policy constitutes acceptance of the changes. If you do not agree, you may close your account by contacting us.

16. Contact Us

For all privacy enquiries, data subject rights requests, regulatory correspondence, or Data Processing Agreement and Business Associate Agreement requests: