1. Operational Scope & Fiduciary Characterization
This Privacy Policy and Sovereign Data Governance Statement applies across all ingestion points, distributed sensory collectors, API interfaces, and cloud-native services comprising the VaST Cybersecurity Platform.
Pursuant to the provisions of the Digital Personal Data Protection Act, 2023 (Republic of India):
VaST operates as a Significant Data Fiduciary solely regarding administrative personnel identities, enterprise tenant credentials, billing contact points, and direct telemetric telemetry of platform administrators within our tenant registry.
Scope: Administrative Identity RecordsWhen ingesting customer corporate telemetry, endpoint event streams, syslog captures, and network packets on behalf of enterprise tenants, VaST functions solely as a Data Processor under instructions specified in the Master Service Agreement.
Scope: Enterprise SIEM & Telemetry Payload2. Classification: Security Telemetry vs. Personal Data (PII)
The VaST Platform enforces deterministic, hardware-isolated boundary separation between non-identifiable telemetry primitives required for real-time cyber defense and identifiable Digital Personal Data.
- Ephemeral IP packets, NetFlow, DNS metadata
- Cryptographic file hashes (SHA-256, MD5, SSDEEP)
- Sysmon process execution strings and parent-child trees
- Firewall transit logs, IDS/IPS signatures, and WAF drops
- Volatile memory dumps collected during live quarantine
- Enterprise SOC Analyst Full Names & Corporate Emails
- Hardware Security Key IDs, MFA seeds, & session tokens
- Grievance correspondence and statutory request logs
- Audit trails linking specific human analyst actions to assets
- Directory service synchronized user profile objects
3. Statutory Legal Bases for Ingestion & Analytics
Processing of any Digital Personal Data within VaST is strictly prohibited without anchoring in one of the statutory anchors explicitly ordained under Indian jurisprudence:
Affirmative Consent (§6 DPDP Act)
Free, specific, informed, unconditional, and unambiguous consent obtained with notice prior to the ingestion of administrative identities, marketing subscriptions, or identity federation profiles. Consent notices are rendered in 22 Eighth Schedule Indian Languages upon demand.
Statutory Threat Mitigation (§7(b) DPDP Act)
Processing undertaken for responding to cybersecurity incidents, containment of zero-day exploits, system breaches, or fulfilling mandatory operational directions issued under Section 70B of the Information Technology Act, 2000.
Compliance with Law & Judicial Orders (§7(c))
Retention of administrative and platform change telemetry in satisfaction of statutory directives issued by CERT-In, the Reserve Bank of India (RBI Cyber Security Framework), and SEBI Cyber Resilience Mandates.
4. Cryptographic Storage & Sovereign Indian Hosting Architecture
VaST maintains an absolute Zero Data Deviation Guarantee. All customer workloads, log repositories, SIEM caches, indexing clusters, and administrative credential tables reside exclusively within the physical sovereign territory of India.
Mumbai (BOM-01)
Tier-IV MeitY Empanelled Data Center. ISO 27001, SOC 2 Type II certified.
Hyderabad (HYD-02)
Synchronous Active-Active mirror with 100% geo-fenced replication links.
AES-256-GCM / HSM
FIPS 140-3 Level 3 Hardware Security Module located inside India.
Enterprise tenants retain exclusive root authority over envelope encryption keys. VaST personnel, automated operators, and external subcontractors have zero algorithmic capability to decrypt stored customer payload logs without real-time ephemeral KMS authorization grant from the tenant administrator.
5. Data Retention & Deterministic Purging Schedules
In strict observation of Section 8(7) of the DPDP Act 2023, data is irreversibly expunged upon the cessation of purpose or upon valid withdrawal of consent, except where statutory retention under Indian criminal or financial legislation supersedes.
| Data Classification | Storage Tier | Retention Horizon | Purging Protocol |
|---|---|---|---|
| Hot SIEM Telemetry Logs | NVMe Flash Hot Pool | 90 Calendar Days | Automated roll-over to Glacier Cold Tier |
| Cold Archived Forensics | Encrypted Object Cold | 365 Calendar Days | DoD 5220.22-M cryptographic zero-out |
| DPDP Consent Artifacts | Append-Only WORM | Perpetual / Active Account + 7Y | Statutory immutable ledger preservation |
| Inactive Admin Credentials | Tenant Vault Core | Purged within 30 Days | Hard delete with cryptokey destruction |
| CERT-In SLA Incident Logs | Regulatory Vault | 5 Years (Statutory Mandate) | Preserved pursuant to CERT-In 2022 Dir. |
6. Sub-Processors & Multi-Tenant Enclave Isolation
VaST prohibits the unvetted sub-contracting of personal data processing. All downstream infrastructure partners are contractually bound under Indian Data Processing Addendums containing liabilities mirroring or exceeding those imposed under the DPDP Act 2023.
Sify Technologies & Yotta D1
Bare-metal colocation & power. Zero access to physical storage drives or logical hypervisors.
LOCATION: MUMBAI & GREATER NOIDATata Communications Ltd.
Dark fibre links utilizing hardware-level MACsec L2 encryption between availability zones.
LOCATION: PAN-INDIA DOMESTIC TRANSIT7. Statutory Data Principal Rights
In accordance with Chapter III of the Digital Personal Data Protection Act, every citizen (Data Principal) whose identifiable data is retained or processed by VaST holds the following irrevocable, legally actionable rights:
Right to Access (§11)
Obtain a summary of personal data being processed, details of all fiduciaries with whom it was shared, and the identities of processing services.
Correction & Erasure (§12)
Mandate the immediate rectification of inaccurate data, completion of incomplete records, and deterministic erasure of obsolete data.
Grievance Redressal (§13)
Direct access to designated Grievance Officers with guaranteed formal findings published within 72 business hours.
Right to Nominate (§14)
Designate any legal individual to exercise data principal rights in the event of death or physical incapacitation.
Consent Revocation (§6(4))
Withdraw granted consent at any juncture via a zero-friction single-click statutory interface matching original onboarding ease.
Appeal to DPBI Board
Unrestricted statutory recourse to escalate unresolved grievances directly before the Data Protection Board of India.
8. CERT-In Dual-Clock Notification & Breach Protocol
VaST maintains deterministic automated incident declaration rails synchronized with the statutory requirements of CERT-In Direction No. 20(3)/2022-CERT-In and Section 8(6) of the DPDP Act 2023.
Formal preliminary dispatch to the Indian Computer Emergency Response Team (CERT-In) incident desk within 6 hours of incident validation across any of the 20 mandated cybersecurity event categories.
TARGET: INCIDENT@CERT-IN.ORG.INConcurrently notify the Data Protection Board of India and impacted Data Principals describing breach nature, compromised data fields, immediate containment measures, and recommended protective actions.
MANDATE: DPDP ACT 2023 §8(6)9. Statutory Grievance Redressal Officer & DPO
Pursuant to the provisions of the Digital Personal Data Protection Act 2023, VaST Technologies Limited has designated a permanent, India-based Data Protection Officer and Grievance Redressal Authority:
Adv. S. K. Narayanan
Chief Data Protection & Regulatory Compliance OfficerBAR COUNCIL ENROLLMENT: KAR/3104/2008VaST Technologies Limited
Level 8, Executive Tower-B, VaST Towers,
Outer Ring Road, Bellandur, Bengaluru,
Karnataka, India – 560103
10. Charter Revision History & Tamper-Evident Ledger
Every amendment to this privacy statement is cryptographically signed and published to a public immutable audit chain. Data Principals are notified at least thirty (30) days prior to any material change impacting the scope of processing.
| Version | Effective Date | Material Revision Summary | Commit Checksum |
|---|---|---|---|
| v4.2-PROD | 14 May 2026 | Full statutory alignment with DPDP Rules 2025; integration of automated DSR portal. | e4a1..99bc |
| v4.0-REL | 02 Dec 2025 | Updated CERT-In 6-Hour SLA logging mechanics; added BYOK crypto keys framework. | 87ff..1102 |
| v3.8-GA | 18 Jan 2025 | Initial post-enactment baseline under Digital Personal Data Protection Act, 2023. | c19a..40ee |