Datic Datic Book a demo
Process Across software Features Geographies Pricing Book a demo
Data protection · Datic Sukyaan

Your data stays
yours. In writing.

The commitments we sign with every Sukyaan client under the DPDP Act, 2023 and the DPDP Rules, 2025.

DPDP Act 2023 compliantGDPR compliantAES-256 encrypted

00At a glance

DPDP Act 2023
DPDP Act 2023Compliant
GDPR
GDPRCompliant
AES-256
AES-256-GCMEncrypted
India onlyWhere your data livesDatic's servers in India, or your own server.
AES-256-GCMPer-company keysFiles and sensitive fields sealed with a key only your company has.
24 h · 72 hBreach noticeNotified within 24 hours; full details within 72.
0AI training on your dataNever, by us or any provider. This survives termination.

01Your role and ours

YouData Fiduciary

Personal data in your systems is yours. You decide its purpose and give individuals the notices the DPDPA requires.

DaticData Processor

We process that data only on your behalf, only on your documented instructions, and only for the scope agreed in writing.

02Two hosting models. You choose.

A · Datic Cloud

Sukyaan runs on Datic's servers in India. Each company's data is kept apart by the database itself, in storage reserved for you, encrypted with your own key.

B · Self-hosted

Sukyaan runs on your own server and all data stays there, under your control. The connector talks to it over your office network. Datic holds nothing during the subscription.

We prefer to host on your servers. Datic never imposes a storage location.

03How Sukyaan works with your systems

  • No migration. Sukyaan plugs into your ERP, CRM, Tally, Excel and other tools. Your original records stay where they are.
  • Read first, write only with approval. It writes back only through steps you have set up and approved.
  • A connector you can trust. Installed on your Tally or ERP computer, it connects over an encrypted channel, identifies itself with its own certificate and is linked to your company with a one-time pairing code.
  • No content on the connector. It keeps only a technical activity log, never your records.

04Access ends when consulting ends

01
ConsultingOur team works with your data to understand your business and build your solution, on systems located only in India.
02
SubscriptionNo routine access to your data. Staff see only operational signals (document counts, connector status, failed jobs), never content.
1h
Support, only when you askA one-hour session, for a stated reason, with your permission. Every access is recorded in a log you can see.
15d
Consulting copies deletedAny copies made outside the platform are permanently deleted within 15 days, including from backups.

05Your right to stop, at any time

You can end the engagement at any point, including mid-way through consulting.

0
All work stops immediatelyThe moment you tell us.
7d
Keys destroyed, live data erasedDatic Cloud: your encryption keys are destroyed and records erased. Backed-up keys expire, so no backup can be read by anyone.
15d
Everything goneAll remaining copies and backups expire. Self-hosted: we delete anything we hold and give you written steps to remove the platform.
Written confirmationOn request. The only exception: one year of sign-in and activity logs the DPDP Rules require, kept restricted for security only.

06Security safeguards

Per-company encryptionFiles, bank details, PAN, Aadhaar, IFSC, phone numbers and emails sealed with AES-256-GCM, using your company's own key, itself protected by a master key kept outside the database.
Isolation by the databaseSeparation between companies is enforced by the database, with the platform connecting through a login that cannot bypass it.
Encrypted everywhereHTTPS/TLS on every connection; certificate-based identity for connectors.
Strong sign-inPasswords stored only as Argon2id hashes; optional two-step verification; role- and department-based access.
Full accountabilityActivity logs of sign-ins and important actions, plus a support-access log.
Tested recoveryNightly backups, test-restored every night, with an encrypted copy kept by a separate provider in India.

Self-hosted: the software ships with these safeguards; your server, network, backups and master key are under your control.

07Breach notification

24h
You are notifiedWithout undue delay, and within 24 hours, so you can meet your own duty under Rule 7 of the DPDP Rules, 2025.
72h
Full detailsNature, scope, timing, likely consequences and the measures taken.
Full cooperationIn investigating and remediating the incident with you.

08Retention and automatic deletion

Each kind of data is kept only as long as its purpose needs, then deleted automatically. Periods marked with a range can be changed by your administrators in Settings › Data & privacy. Below is Datic Cloud; self-hosted uses the same defaults on your own server, where Datic has no access.

WhatWhyHow longAdjustable / deletion
Uploaded and vendor-portal filesEvidence behind the details Sukyaan reads; GST record-keeping8 years default30 days to 10 years
Copies of data synced from Tally or ERPTo process and reprocess what your systems send30 days default7 days to 1 year
Extracted business recordDocuments register, vendors, reports, anomalies, approvals: the service itselfFor the subscriptionErased within 15 days of ending
User accounts and vendor-portal loginsSign-in and access controlFor the subscriptionErased within 15 days of ending
Vendor-portal submissionsOnly fields on your form; sensitive fields encryptedFor the subscriptionErased within 15 days of ending
Datic AI conversationsContinue a conversation and see its history180 days default7 days to 1 year
Sign-in and password-reset recordsSecurity, as the DPDP Rules require1 yearDaily automatic clean-up
Activity and support-access logWho did what, and every Datic support accessSubscription + 1 yearDeleted at end of that year
Server logsSecurity monitoring and investigation1 yearDeleted automatically
Emails sent on your behalfDelivery, retries and troubleshooting30 daysDaily automatic clean-up
Database backupsRecovery from failure, mistakes or attackLast 14 nightly copiesOldest deleted each night
Backups of your encryption keysRecovery; kept apart from data backups7 daysAfter expiry, erased data is unrecoverable

No long-term archives, shadow copies or other backup repositories. Proof of deletion is available within 15 days of a request.

09Where data is processed, and AI

Client data is stored only in India, with backups in India, and never transferred to a country restricted under Section 16 of the DPDPA.

In IndiaAlways on

Reading scanned documents (Sarvam AI). Search runs on the same server as the platform, so documents are not sent elsewhere.

Outside IndiaYour choice

Reading document details and Datic AI answers use Anthropic's Claude, one task at a time, never stored for training. Switched off unless you permit it.

Your data will never be used to train AI. Not by Datic, not by any provider. Datic builds no foundation models and scrapes no public data. This commitment survives termination indefinitely.

10GDPR compliance

For clients and individuals in the EU, EEA and UK, Sukyaan meets the requirements of the General Data Protection Regulation through the same safeguards described above.

Processor on your instructionsDatic acts only on your documented instructions, for the scope agreed in writing (Article 28).
Minimisation and storage limitsOnly what the service needs is kept, and every category is deleted on a fixed schedule (Article 5).
Security of processingPer-company AES-256-GCM encryption, database-enforced isolation, Argon2id passwords and tested backups (Article 32).
Breach notice in 24 hoursYou hear from us within 24 hours, well inside the 72-hour authority deadline (Article 33).
Data subject rightsAccess, rectification, erasure, restriction, portability and objection, actioned in the platform within 7 days of your request.
No transfers without your consentData leaves India only for AI features you permit, and is never used to train any model.

11Vendor portal

Datic Cloud

Vendors sign in with logins you create and see only the forms you give them. Only fields on your form are stored; bank account, PAN, Aadhaar, IFSC, phone and email are each encrypted with your key.

Self-hosted

The portal runs on your server behind a Cloudflare Tunnel, with no inbound firewall ports. Only portal pages are published; everything else is refused twice. Cloudflare stores nothing.

12Service providers

Each is bound by terms no less protective than ours. You are told in writing at least 30 days before we add or replace one, and you may object.

ProviderWhat it doesWhereApplies to
HostingerServers that run Datic Cloud and store its dataIndiaDatic Cloud
Amazon Web Services (S3)Encrypted off-server copy of backupsIndia (Hyderabad)Datic Cloud
Sarvam AIReading text from scanned documentsIndiaBoth
Anthropic (Claude)Reading details from documents; Datic AI answersOutside India, only if permittedBoth
CloudflareCarrying vendor-portal traffic; certificates for your addressesGlobal network, nothing storedSelf-hosted
Email delivery providerScheduled reports, password resets and alertsNamed to you in writing firstBoth

13Personal-data requests and governing law

When an individual asks you to access, correct, update or erase their personal data, or raises a grievance, we carry out whatever is needed in the platform within 7 days of your request. We never respond to individuals directly except on your instructions.

These commitments are governed by Indian law (the DPDP Act 2023, the DPDP Rules 2025 and the Indian Contract Act 1872), with arbitration seated at Kanpur, India. The signed DPDP agreement is supplementary to your Service Agreement and prevails on data protection.

Request the full DPDP agreement

See it on your own data.

Every safeguard on this page applies from day one.

Book a demo View pricing