Your clients’ documents, locked down by default.
Stored in India. Opened only by the people you allow. Every access on record.
Between your clients’ files and everyone else.
Stored in India
App, database and files sit in secure data centres in India.
Encrypted
With TLS while files travel, and on disk while they rest.
No public file links
Files open only through links that expire in 60 seconds.
Upload-only client links
Clients add files but can never see any. A forwarded link shows nothing.
Codes and lockouts
Every request has its own 6-digit code. Repeated wrong codes lock the link.
Every access on record
Views, downloads, uploads and deletes, with name, time and IP address.
Everyone sees only what their work needs.
- Owner, Manager and Staff roles
- Staff see assigned clients only
- Owner login needs an emailed code
- Signed out after 30 minutes idle
- Password again before deletes and exports
- Switch off any login in one click
Backed up, recoverable, and easy to investigate.
- Nightly encrypted backups
- Copy kept in a second Indian city
- Deleted files restorable for 7 days
- See every file a person opened, by date
- We tell you quickly about any breach
Safe file types only
PDF, Word (.docx), Excel (.xlsx), CSV, JPG and PNG, up to 25 MB. Each type is checked twice. Files open from a separate storage address, so a harmful file cannot act inside Reposha.
Our own staff stay out
Reposha admins see account details only, never client names or files. Your documents are never sold, never sent to outside AI companies and never used to train any model.
The safeguards the law asks for, side by side.
| Rule | What it asks | What Reposha does |
|---|---|---|
| 6(a) | Secure the data, for example by encryption | Encrypted in transit and at rest. Files and database stored in India. |
| 6(b) | Control who can access it | Roles, assigned clients, personal logins, emailed login codes, session limits. |
| 6(c) | Log access and review the logs | Every view, download, upload and delete logged. Monthly Security Report. |
| 6(d) | Keep working if something fails | Nightly encrypted backups, with a copy in a second Indian city. |
| 6(e) | Keep logs for a year | 12 months in the app with filters and export. Older months archived. |
| 6(f) | Contract with your Data Processor | Data processing terms are part of our Terms of Use. |
Reposha handles the document side of these duties. Your lawful purpose, privacy notice and breach plan stay with your business. Read the DPDP guide
We do not hold ISO 27001 or SOC 2 certificates yet. No certificate makes a business “DPDP compliant”, so we do not claim one. We tell you exactly what we do, so you can check it.
Email support@reposha.com with “Security” in the subject. We aim to reply within two working days. Need zero cloud processing? Ask about Precepts Core, our on-premise option.