Government & public sector
What a review would want to know
Where the data physically is, what the law requires of us, and the list of things we have not done. Written for somebody whose job is to find the gap.
Where the data physically sits
Measured on 28 September 2026 from the production server, not read off a contract. The answer is not uniformly “India”, and the row that is not is the one that matters most.
Application servers
Bangalore, IndiaHow we know: DigitalOcean region blr1, reported by the droplet's own metadata service.
Database — accounts, incidents, evidence records
Bangalore, IndiaHow we know: Managed PostgreSQL answering in 1.0 ms from the blr1 application server; Singapore is 144 ms away from it.
Evidence files themselves
SingaporeHow we know: Object storage bucket in DigitalOcean region sgp1. Bangalore object storage exists and this has not been moved to it yet.
Card and UPI details
Never reach usHow we know: Payments go directly to Razorpay, who are PCI-DSS compliant. We store only a payment reference.
This marketing website
Global edge networkHow we know: Served from Vercel. It holds no personal data — the contact form posts to the Bangalore application.
The evidence files are not in India, and they should be
Records of crimes committed against people in India are currently stored in Singapore. That is lawful — section 16 of the Digital Personal Data Protection Act 2023 permits transfer outside India except to countries the Central Government restricts, and none has been notified — but lawful is not the same as right for this particular data.
DigitalOcean offers object storage in Bangalore and we have not moved to it. We would rather tell you that than let you discover it during a review.
Our position under the DPDP Act 2023
The Act received assent in August 2023 and the Digital Personal Data Protection Rules were notified on 14 November 2025, with an eighteen-month phased compliance period — so the substantive obligations land around May 2027.
We do not describe ourselves as “DPDP compliant”, because nobody can be. There is no certification scheme and no authority issuing one. The Act creates obligations; it does not create a badge. A vendor claiming the badge is telling you they have not read it.
What we can point at is architecture. Consent is enforced as a precondition in code — every route touching evidence refuses the request outright unless the account has explicitly enabled it, before any handler runs. Purpose limitation follows from the same gate. Data minimisation is why the mobile app asks for no SMS permissions at all, and why a test fails if they come back.
Evidence integrity and chain of custody
Files are fingerprinted with SHA-256 by the server, from the bytes it actually received rather than from a hash the client supplied. A verification re-reads the stored file and fingerprints it again, and records the result either way — a failed check is stored as a failed check.
The evidence record refuses its own updates and refuses deletion, including by us. Encryption is per-file and authenticated, so altered data does not decrypt into slightly different data — it refuses to decrypt at all.
We do not claim court-admissibility. That is a matter for a court and for the law of evidence, not for a vendor to assert on a web page.
Procurement status: nothing yet
Every one of these is checkable against a public register, so here is the list rather than a silence you would have to interpret.
- GeM (Government e-Marketplace)
- Not listed. We have not begun the seller onboarding process.
- STQC certification
- Not held and not applied for. STQC testing is something we expect to need before a public-sector deployment; we have not started it.
- CERT-In empanelment
- Not empanelled. We are not an empanelled auditor and do not present ourselves as one.
- ISO 27001 / SOC 2
- Neither held. No audit has been undertaken.
We are not publishing target dates for these. A date on this page would be a commitment we have no basis for, and a missed one tells you more about us than the gap does. If a procurement timeline depends on any of them, ask us directly and you will get an honest answer, including “we do not know”.
Who you would be contracting with
Laabam One Business Solutions OPC Pvt Ltd, a One Person Company registered in India. Our registered address and other ways to reach us are on the contact page.
Nothing we sell is released yet. Each product page states where it stands and how that was established — see the organisation overview for the commercial picture.