Trust centre
Everything your security team will ask for.
Where your data goes, how dwaar is secured, how to check our records, and how this website itself handles your visit.
- Requests
- Processed by models hosted in India
- Our systems
- Run in India
- Records
- Signed, checkable offline
- Security pack
- Request it
01Your data
Where your data goes.
Every service that touches a request, and where it runs.
| Sub-processor | What it does | Where |
|---|---|---|
| [model hosting providers] | Run the models that answer your requests | India |
| [gateway hosting] | Runs the dwaar gateway and stores records | India |
| Zoho Mail | Our mailbox for requests and support | India |
We publish changes to this list before they take effect.
02Security
How dwaar is secured.
- A signed list of endpointsdwaar only routes to model endpoints in a registry that is reviewed and cryptographically signed. An unsigned or expired registry is never used.
- Outbound traffic, locked downThe gateway can only open connections to approved hosts in India. Anything else is blocked before a byte leaves.
- Encrypted in transitEvery connection, from your app to dwaar and from dwaar to the model, uses TLS.
- Logs stay in IndiaOperational logs and request records are stored in India, and logs are not copied elsewhere.
- Responsible disclosureReport a vulnerability to support@dwaargateway.in.
03Records
Check any record yourself.
Every request gets a signed record of where it ran. Our public signing keys let you verify a record offline, without asking us.
- Current signing key[key id]
- Where the keys areGET https://api.dwaargateway.in/v1/receipts/keys
- VerifierAn open-source command-line verifier and a short Python script.
- What a record provesThat dwaar issued it and it has not changed, and which approved endpoint in India served the request. How a provider handles data after that is covered by its contract.
04Regulations
Controls that support your obligations.
| Framework | Who it applies to | How dwaar helps |
|---|---|---|
| SEBI | Brokers, AMCs, market infrastructure | Requests stay on models hosted in India, with a record of each one |
| RBI | Banks and NBFCs | Data localisation and outsourcing evidence, request by request |
| IRDAI | Insurers | Policyholder data processed in India, with records for audit |
| DPDP Act | Everyone handling personal data | Processing in India, sub-processors listed, records kept |
| ABDM | Health data | Health data handled by models hosted in India |
Not legal advice. Controls that support your obligations; your own assessment still applies.
05This website
This website collects almost nothing.
No analytics, no trackers, and nothing loaded from another website.
- Hosting and TLSServed through Cloudflare’s network, which also provides its DNS and certificate. This website holds no customer data; the API and every model run in India.
- Visit logsWe keep none. Cloudflare handles the network traffic to this website under its own policy.
- EmailOur mailbox is hosted in India.
Start building with sovereign AI.
Open models, hosted in India, behind one API key.