NoIdMeConsent Cloud
Sign inBook a demo
Trust

Security you can verify

We build privacy infrastructure, so our own posture has to hold up. Here's how the platform protects data, and an honest account of what we do and don't claim.

RLS-provenPer-request row-level security — a forgotten scope returns zero rows, not another tenant's data.
crypto-shred §12Erasure destroys the per-principal key; sealed PII becomes unrecoverable, even from backups.
append-only ledgerTamper-evident hash chain anyone can verify with the published key.
Cloudflare edgeCSP, HSTS, X-Frame-Options and a strict permissions policy at the edge.
Architecture

How data is protected

Tenant isolation

Multi-tenant Postgres with row-level security keyed per request. A forgotten scope returns zero rows, not another tenant's data. Proven against real RLS.

Crypto-shred erasure

§12 erasure destroys the per-principal key. Sealed PII is unrecoverable, including from WAL/backups. This is not a soft delete.

Non-repudiation

Per-tenant signing (HMAC / ECDSA / KMS). KMS-backed keys keep the private half out of the process and survive restarts.

Tamper-evident ledger

Append-only hash chain. Any tampering breaks verification, which anyone can run with the published key.

Edge security headers

Served from Cloudflare with CSP, HSTS, X-Frame-Options and a strict permissions policy.

Least-privilege keys

Publishable / secret / read-only / operator key classes; secrets never reach the browser; per-IP rate limiting.

Honesty

What we claim, and what we don't

We do claim

  • Evidence-grade, tamper-evident consent (§6/§6(10)).
  • Real crypto-shred erasure and RLS tenant isolation.
  • A fail-closed §9(3) children gate.
  • Self-host so your data can stay in your VPC / region.

We do NOT claim

  • To be a registered §6(10) Consent Manager (that registry opens later in 2026).
  • "DPDP-certified" or "Board-approved". No such certification exists to hold.
  • Legal advice. Notice content and DPDP guidance are counsel-gated.
  • SOC 2 / ISO 27001 yet. It's on the roadmap; we'll publish reports when audited.
Note on this website: static security headers (CSP/HSTS) are enforced at Cloudflare's edge. We do not run a real-time status page yet. We'll link a third-party status service at GA rather than imply uptime we don't measure.

Verify it yourself

Run the ledger verification, inspect the RLS isolation, and see crypto-shred erasure in a live demo.

Book a demoRead the docs