Trust & security
A Consent Manager should be the most trustworthy party in the room. Here is how we earn that.
Every consent event is canonicalised (RFC 8785), hashed with SHA-256 into a chain and signed with an ECDSA P-256 key that never leaves a hardware security module, plus a post-quantum ML-DSA-65 signature. Anyone holding a receipt can check it in the browser or offline, without seeing anyone’s personal data.
Personal data is stored and processed only in India, in our Mumbai data region. Our global CDN and web firewall configuration does not store personal data.
We record consent decisions, not browsing. Phone numbers are encrypted with envelope encryption and looked up via keyed hashes.
Withdrawal is as easy as giving consent. Companies are notified by signed webhook and must acknowledge. Our promoter and registration disclosures are published as they are finalised.
This site uses only what it needs to work. Anything optional stays off until you say yes.