Skip to main content
Understanding what data a third-party API provider stores — and what it explicitly does not store — is a prerequisite for onboarding at most regulated financial institutions in India. This page gives you a precise, unambiguous breakdown of FraudTrace AI’s data handling practices so you can complete vendor assessments, satisfy your data protection officer, and meet RBI data localisation requirements with confidence.

​
What Data FraudTrace AI Stores

FraudTrace AI’s database contains intelligence about fraud actors — not about your customers or their transactions. The data stored is limited to:
  • Fraud-actor UPI Virtual Payment Addresses (VPAs): The UPI IDs associated with mule accounts, scam operations, and fraudulent merchant registrations, indexed from publicly observable fraud signals.
  • Source URLs of fraud sites: Web addresses of phishing pages, fake investment platforms, and scam storefronts identified by our intelligence pipeline.
  • Archived screenshots: Visual evidence of fraud pages at the time of detection, retained as evidentiary artefacts.
  • Timestamps: The date and time each fraud signal was first and most recently observed.
  • Fraud category metadata: Classification labels such as MULE_ACCOUNT, PHISHING, INVESTMENT_SCAM, FAKE_MERCHANT, and associated confidence scores.
None of the above constitutes personal data of a bank customer, payment sender, or payment recipient. The indexed entities are fraud actors — not the victims of those fraud actors.

​
What FraudTrace AI Never Stores

FraudTrace AI does not receive, process, or retain any of the following — and your API integration does not transmit any of it either.
Your customers’ data stays entirely within your systems. The only thing you send to FraudTrace AI is the UPI VPA string you want to check — nothing else is required or transmitted.

​
What You Send to the API

A typical FraudTrace API call looks like this:
The request body contains only the UPI VPA you are screening. No customer name, no transaction amount, no account number, no device data — nothing else. FraudTrace AI does not ask for it, and you should not send it.

​
Data Residency

All FraudTrace AI data — the fraud intelligence database, archived screenshots, audit logs, and API infrastructure — is hosted exclusively on AWS Mumbai (ap-south-1).
No data is replicated to, processed in, or accessible from any region outside India. This satisfies RBI data localisation requirements for third-party API integrations at banks and regulated payment institutions.
If your information security policy requires written confirmation of data residency, contact support@fraudtraceai.com to request a data residency attestation letter.

​
DPDP Act 2023 Compliance

India’s Digital Personal Data Protection Act 2023 applies to the processing of personal data of individuals. FraudTrace AI’s compliance position is straightforward:
  • The data FraudTrace AI processes consists of fraud-actor identifiers (UPI VPAs) sourced from publicly observable fraud sites and intelligence feeds — not personal data of bank customers or payment users.
  • FraudTrace AI does not act as a Data Fiduciary under DPDP for any of your customers’ personal data, because it never receives or stores that data.
  • You do not need to obtain your customers’ consent for FraudTrace API calls, because you are not sharing your customers’ personal data with FraudTrace.
Share this page with your Data Protection Officer or Legal team when completing your DPDP Act compliance review for third-party processors. The key finding is that FraudTrace AI does not process personal data of your customers, removing it from the scope of most DPDP obligations that would apply to a data processor relationship.

​
Audit Logs

Every API request your system makes to FraudTrace AI is recorded in an immutable audit log that includes:
  • The timestamp of the request
  • The API key identifier used (not the key value itself)
  • The endpoint called
  • The response status and fraud signal returned
Logs are tamper-evident and retained for compliance purposes. If you need access to your request logs — for example, for an internal audit, a regulatory inspection, or an incident investigation — contact support@fraudtraceai.com with your account details and the relevant date range.

​
Evidence Retention

Screenshot archives and other evidentiary artefacts associated with a fraud cluster are retained for as long as the cluster remains active and relevant to ongoing fraud detection. When a fraud cluster is retired, associated artefacts are reviewed for retention or deletion based on the then-current retention policy.

​
API Key Management

Your API key is the credential that authenticates your integration. Keep it secret — do not commit it to source control or expose it in client-side code. If you believe your key has been compromised, or if you want to rotate it as part of a routine security review, contact support@fraudtraceai.com. Key rotation is handled immediately: your new key is issued and the old key is invalidated at once, with no grace period.
Any in-flight requests using the old key at the moment of rotation will fail with a 401 Unauthorized response. Update your integration to use the new key before requesting rotation in a live environment.