Skip to content
DigAI
Verifiable Engineering Controls

Security, in plain language.

What we do, what we don’t claim, and how to ask for more. No vague marketing adjectives (“bank-grade!”) — only verifiable codebase facts and honest engineering statuses.

Visit Trust Center
Codebase Safeguards

Platform Security Controls

Every control reflects real repository verification or a clearly marked roadmap milestone.

Infrastructure & DataLive

Multi-Tenant Organization Isolation

All CRM records, messages, workflows, and media are keyed by organizationId at the database query level. Automated cross-tenant isolation test suites run on every commit in our CI pipeline.

Verified in repo: Automated cross-tenant isolation tests and an isolation audit script in CI
Access & IdentityLive

Session Authentication & Password Security

JWT authentication delivered via secure cookies with automatic expiry and rotation. Passwords hashed using bcrypt/argon2 {{CONFIRM_ALGO}} with cryptographic salt before storage.

Verified in repo: JWT auth delivered via cookies
Access & IdentityLive

Role-Based Access Control (RBAC)

Administrators define permissions for CRM, Unified Inbox, Workflows, LMS, and Billing. The backend enforces permissions via a dedicated server-side permissions guard, preventing client spoofing.

Verified in repo: Role-based staff permissions enforced by a backend permissions guard
Application SecurityLive

Platform Admin Audit Logging

Administrative events (role updates, pipeline modifications, API changes) generate immutable audit records. Customer-facing staff activity audit log {{CONFIRM}} is in active progress.

Verified in repo: Platform-admin audit log
Application SecurityLive

Signed Engagement Tracking Tokens

Outgoing marketing and transactional email links utilize HMAC-signed cryptographic tokens. Unsubscribe and redirect endpoints verify signatures before updating lead engagement scores.

Verified in repo: Signed tracking tokens on email click/open links
Infrastructure & DataLive

Zero-Storage Payment Security

Customer checkouts are handled entirely within Razorpay’s PCI-DSS compliant payment frames. DigAI only receives cryptographically signed webhook callbacks for payment verification and invoice creation.

Verified in repo: Razorpay for payments (card data never touches DigAI servers — confirm wording with owner)
Infrastructure & DataLive

Encryption in Transit

All traffic between browser clients, webhook endpoints, and the API gateway is encrypted via TLS 1.3 {{CONFIRM_TLS}}. HSTS headers enforce HTTPS everywhere.

Infrastructure & DataIn progress

Encryption at Rest

Managed database volumes and cloud object storage are encrypted at rest with AES-256 {{CONFIRM}}. Key management rotation procedures are under review.

Access & IdentityPlanned

Two-Factor Authentication (2FA) & SSO

TOTP mobile authenticator support is in development for Q1 2027. Enterprise SAML/SSO is scheduled on our public roadmap.

Audits & CertificationsPlanned

Independent SOC 2 Type II & ISO 27001

DigAI operates on self-assessed security controls and automated CI isolation tests. Formal SOC 2 and ISO 27001 third-party audit cycles are planned on our compliance roadmap {{EVIDENCE_LINK}}.

Interactive Architecture Map

How your customer data flows through DigAI

Tap any node in the architecture below to inspect data handling, encryption standards, and subprocessor links.

Architecture Topology
Inspecting Component

DigAI Application Gateway

Data Handled
JWT cookie sessionsNormalized payloadsAudit telemetry
Encryption Standard
TLS 1.3 in transit, tenant-scoped validation
Architectural Role

Validates origin, verifies organization membership, and enforces RBAC permission guards.

Boundary Clarity

Shared Responsibility Model

Security is a collaborative partnership between DigAI’s cloud platform and your internal workspace administration.

Operational Area
What DigAI Handles
What You Handle
Tenant & Database Isolation
Enforcing organization-scoped queries, database access controls, and automated cross-tenant CI isolation tests.
Managing which team members are invited to your organization workspace.
Staff Account Security
Hashing passwords securely, enforcing JWT cookie expiration, and providing server-side RBAC permissions.
Staff password hygiene, revoking access when team members leave, and assigning appropriate role tiers.
Messaging & Consent
Providing template approval syncing, anti-ban pacing, consent tags, and instant opt-out keywords.
Obtaining verified opt-ins before sending marketing broadcasts, and respecting local communication laws.
Payments & Financial Data
Ensuring zero credit card data enters DigAI servers, and verifying webhook cryptographic signatures from Razorpay.
Safeguarding your Razorpay merchant secret keys and configuring appropriate bank settlement accounts.
API & Webhook Endpoints
Enforcing rate limits, validating incoming JSON formats, and providing HMAC-signed payload headers.
Verifying secret headers on your external receiving webhooks and keeping API credentials confidential.
Security Researchers

Vulnerability Disclosure Policy

We believe in coordinated vulnerability disclosure. If you identify a suspected security vulnerability in DigAI infrastructure, please report it directly to our security response desk. We pledge not to initiate legal action against researchers acting in good faith.

Email security@digai.in

Frequently Asked Security Questions

DigAI uses a multi-tenant organization-scoped architecture. Every contact, conversation, workflow, and deal is strictly keyed by organizationId. In our continuous integration (CI) pipeline, automated cross-tenant isolation test suites and an audit script verify that queries cannot cross tenant boundaries.

Need vendor security sign-off?

Send us your vendor assessment spreadsheet or request our pre-filled questionnaire package.

Request security packageExplore Trust Center