by
Security
How we protect the records you trust us with.
Consent records are evidence. They have to stay in India, stay unchanged, and be seen only by the people you allow.
Where your data lives
In India, with every exception named.
Data centres in India
Primary systems run in Mumbai. Database backups are copied to a second Indian region, in Hyderabad.
AI processed in India
Paper reading and translation drafts run in India. Your data is not used to train AI models.
Named service providers
Every provider that handles personal data is listed on our Service providers page, with the few routes that can leave India, such as WhatsApp.
Protecting data
Encrypted, scanned and kept unchanged.
Encryption at rest
Databases and files are encrypted with managed keys that rotate. Evidence files have their own dedicated key.
Encryption in transit
Every connection uses HTTPS, with strict transport security on our sites.
Write-once evidence
Evidence files are kept write-once as proof of consent, for 7 years by default, so they cannot be altered. Only roles you allow can see them.
Malware scanning
Every uploaded scan, recording and document is checked before it counts as evidence.
Edge protection
A web application firewall with managed rules and rate limits sits in front of the app.
Secrets kept apart
Passwords and keys live in a secrets store, never in code. API keys are stored only as hashes.
Who can reach it
The right people, and only them.
Six roles
Admin, Consent Operator, Data Controller, Viewer, DPO and Auditor. A DPO sees only the fiduciaries they are given.
Single sign-on
Sign in through your own identity provider, with users added and removed automatically. Set up per organisation.
Strong sign-in
Multi-factor sign-in is available, and accounts lock after repeated failed attempts.
Each organisation apart
Every organisation's records are kept apart at the database level.
Scoped API keys
Keys limited to what each system needs, and optionally tied to your network addresses.
Second approver
Publishing a form can need a second person's approval.
Logs and audit
Every action leaves a trace you can check.
Hash-chained audit log
Each event is chained to the one before it and the chain is checked every night.
Export
Export the audit log to CSV, or stream it to your SIEM.
Registers and packs
Breach, grievance, withdrawal and erasure registers, and a signed compliance pack.
Leaving us
An offboarding bundle with your records and evidence when you leave.
Masked logs
Application logs mask personal data.
The website
This website sets no cookies and runs no trackers.
Report a problem
Found a security issue?
Write to contact@bluepencil.com with the word Security in the subject. Tell us what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing.
We will acknowledge your report, keep you updated, and credit you if you wish once it is fixed.
Accessibility
Built for everyone who gives consent.
We build Sehmat and this website to WCAG 2.2 AA practices. Every page has an accessibility menu with read-aloud, text size, high contrast, readable spacing, underlined links and a way to stop animations. Consent forms can offer read-aloud, bigger text and high contrast too.
If something does not work for you, write to contact@bluepencil.com and we will fix it.
Questions
Security questions.
Where is Sehmat's data stored?
In data centres located in India. Primary systems run in Mumbai, and database backups are copied to Hyderabad.
Is our data used to train AI models?
No. Paper reading and translation drafts run in India, and your data is not used to train AI models.
Do you sign a data processing agreement?
Yes. Our Terms already include the processor terms the Act requires, and we sign a separate data processing agreement on request.
Can evidence be changed after it is recorded?
Evidence files are stored write-once, for 7 years by default, and every event is chained in an audit log that is checked every night.
Have a security questionnaire?
Send it to usNeed answers for your security review?
Send us your questionnaire and we will fill it in. A data processing agreement is available on request.