Data Processing & Security Addendum (DPA)
Technical and organizational security architecture protecting B2B customer data, Tally Prime ledgers, and encrypted backups.
- Forms an integral part of our Terms & Conditions for all B2B customers, Chartered Accountants, and multi-branch enterprises.
- Documents our physical per-tenant SQLite file isolation, AES-256-GCM secret encryption, SHA-256 tamper-evident audit chains, and 72-hour incident notification SLA.
1. Processing Scope & Documented Instructions
This Data Processing Addendum ("DPA") supplements the Terms & Conditions between Customer (Data Fiduciary / Controller) and RSL Marketing Technologies (Data Processor). RapidShift Labs processes Customer Data solely to execute workflows configured by Customer—such as Tally voucher ingestion, WhatsApp/Inbox delivery, analytics aggregation, and encrypted backup creation.
2. Technical & Organizational Security Controls
RapidShift Labs maintains defense-in-depth engineering safeguards across all production workloads:
- Strict Tenant File Isolation: Separate SQLite WAL databases per tenant ULID with path-traversal validation (
resolveSafeTenantDir) and OS0700directory permissions. - Authenticated Envelope Encryption: OAuth tokens, webhook secrets, and backup payloads use AES-256-GCM with versioned master keys (
KMS_MASTER_KEY) and cryptographic signing (BACKUP_SIGNING_KEY). - Tamper-Evident Audit Chains: Workspace action logs compute sequential SHA-256 chain hashes anchored daily at 00:05 IST.
- Network & Webhook Hardening: Outbound webhook SSRF guards block RFC1918/loopback/link-local/metadata IP ranges; inbound Meta and Razorpay webhooks enforce constant-time HMAC-SHA256 verification.
- Fail-Closed Role-Based Access Control: Every web route, server action, and API key scope fails closed unless explicit permission is granted.
3. Security Incident Notification (CERT-In & DPDP Alignment)
In the event of a confirmed personal data breach affecting your workspace, RapidShift Labs will notify the Workspace Owner without undue delay—and in any event within 72 hours (and within statutory CERT-In reporting windows where applicable)—providing root-cause scope, affected records, and containment actions taken.