Specific claims, because vague ones are worth nothing.
Every product in the suite inherits the same four decisions. They were made once, centrally, and they are the ones that are painful to retrofit later.
Credentials live where nothing else can reach
Passwords and second factors are held by a dedicated credential authority. No browser touches it, no product queries it, and no application database contains a password hash. Signing in is a request to that service and nothing more — so a compromise of any one product does not put credentials at risk.
History cannot be quietly rewritten
Every sign-in, factor change and administrative action is written to an append-only, hash-chained trail. Removing an entry breaks the chain, and a broken chain is visible to you rather than only to us. Admin impersonation requires an explicit, time-boxed grant and appears in your own log.
Isolation is enforced in the database
Tenant scope is injected on every query and row-level security is forced in PostgreSQL. Isolation does not depend on an application remembering to filter, because that is the one thing applications reliably forget. Cross-tenant leakage is treated as an existential failure rather than a bug class.
The disks are in India
Instances, volumes, snapshots, backup copies and databases are created in Indian data centres and do not move out of them. That is a statement about physical location, which is usually the question actually being asked.
Where your data physically is.
Product by product, because a suite-wide sentence is not an answer.
| Product | What is stored | Where |
|---|---|---|
| Comsky Cloud | Instances, volumes, snapshots, backups | Single Indian zone (ZONE01) |
| Comsky Backup | Encrypted per-device vaults, retention history | Indian object storage |
| Comsky CRM | Contacts, deals, email, documents | Indian data centre |
| Comsky TallyBridge | Synced Tally ledgers, per company | Indian data centre, per-company key |
| Every other product | All customer data | Indian data centre |
Where a third-party service is unavoidable — a payment gateway, an SMS or WhatsApp carrier — it is named in the Data Processing Addendum along with what it receives. Ask for the DPA.
The parts that are unglamorous and matter.
Encryption in transit and at rest
TLS on every connection between you and us and between our own services. Data at rest is encrypted, and Comsky Backup additionally encrypts on the machine with a key held per device.
Roles, not all-or-nothing
Per-role visibility inside each product, so a salesperson does not see payroll and an accountant does not see every deal. Offboarding one person removes access to every product at once.
Export and deletion on request
Your data is exportable in an open format without asking us, and deletion requests are honoured and confirmed. Neither is a retention lever we use to keep you.
Alerting on the things that matter
Failed sign-ins, new second factors, admin actions and unusual provisioning raise alerts to the account owner rather than sitting in a log nobody reads.
API tokens with scope
Tokens are scoped to a product and a permission set, are listed with their last use, and can be revoked individually rather than by rotating a shared secret.
Backups of our own systems
The platform databases are backed up and the restores are drilled. A backup nobody has restored is a belief, not a backup — that applies to us too.
What procurement always asks.
Are you ISO 27001 or SOC 2 certified?
Not yet. We would rather say that plainly than imply it. The controls described on this page are in place; the external audit is planned and we will publish the report when there is one rather than the intention.
Can your staff read my data?
Access to production data requires an explicit, time-boxed grant, and every use of it is written to the same hash-chained trail you can see. There is no standing engineer access to customer records.
What happens to my data if I leave?
You export it first, in an open format, without asking us. After the account closes, data is deleted on the published schedule and the deletion is confirmed to you.
Do you have a DPA and a sub-processor list?
Yes — ask and we will send both. The sub-processor list names every third party that could receive customer data and what each one receives.
How do I report a vulnerability?
Email security@comsky.ai. We will acknowledge within one working day, and we will not threaten anyone who reports something in good faith.