> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FraudTrace AI Data Handling, Privacy, and DPDP 2023

> What data FraudTrace AI stores, what it never stores, how data residency works, and how DPDP Act 2023 compliance applies to your integration.

Understanding what data a third-party API provider stores — and what it explicitly does not store — is a prerequisite for onboarding at most regulated financial institutions in India. This page gives you a precise, unambiguous breakdown of FraudTrace AI's data handling practices so you can complete vendor assessments, satisfy your data protection officer, and meet RBI data localisation requirements with confidence.

***

## What Data FraudTrace AI Stores

FraudTrace AI's database contains intelligence about fraud actors — not about your customers or their transactions. The data stored is limited to:

* **Fraud-actor UPI Virtual Payment Addresses (VPAs):** The UPI IDs associated with mule accounts, scam operations, and fraudulent merchant registrations, indexed from publicly observable fraud signals.
* **Source URLs of fraud sites:** Web addresses of phishing pages, fake investment platforms, and scam storefronts identified by our intelligence pipeline.
* **Archived screenshots:** Visual evidence of fraud pages at the time of detection, retained as evidentiary artefacts.
* **Timestamps:** The date and time each fraud signal was first and most recently observed.
* **Fraud category metadata:** Classification labels such as `MULE_ACCOUNT`, `PHISHING`, `INVESTMENT_SCAM`, `FAKE_MERCHANT`, and associated confidence scores.

<Note>
  None of the above constitutes personal data of a bank customer, payment sender, or payment recipient. The indexed entities are fraud actors — not the victims of those fraud actors.
</Note>

***

## What FraudTrace AI Never Stores

<Warning>
  FraudTrace AI does not receive, process, or retain any of the following — and your API integration does not transmit any of it either.
</Warning>

| Category                                   | Examples                                               | Stored by FraudTrace? |
| ------------------------------------------ | ------------------------------------------------------ | --------------------- |
| Personal data of bank customers or victims | Name, mobile number, date of birth, address            | ❌ Never               |
| Bank account identifiers                   | Account numbers, IFSC codes                            | ❌ Never               |
| Financial data                             | Account balances, transaction amounts, payment history | ❌ Never               |
| Internal bank system data                  | Core banking records, KYC files, CRM data              | ❌ Never               |
| Payment recipient data                     | Beneficiary name, beneficiary VPA, purpose code        | ❌ Never               |

Your customers' data stays entirely within your systems. The only thing you send to FraudTrace AI is the UPI VPA string you want to check — nothing else is required or transmitted.

***

## What You Send to the API

A typical FraudTrace API call looks like this:

```bash theme={null}
curl --request POST \
  --url https://api.fraudtraceai.com/v1/vpa/screen \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"vpa": "suspect@upi"}'
```

The request body contains only the UPI VPA you are screening. No customer name, no transaction amount, no account number, no device data — nothing else. FraudTrace AI does not ask for it, and you should not send it.

***

## Data Residency

All FraudTrace AI data — the fraud intelligence database, archived screenshots, audit logs, and API infrastructure — is hosted exclusively on **AWS Mumbai (ap-south-1)**.

<Info>
  No data is replicated to, processed in, or accessible from any region outside India. This satisfies RBI data localisation requirements for third-party API integrations at banks and regulated payment institutions.
</Info>

If your information security policy requires written confirmation of data residency, contact [support@fraudtraceai.com](mailto:support@fraudtraceai.com) to request a data residency attestation letter.

***

## DPDP Act 2023 Compliance

India's **Digital Personal Data Protection Act 2023** applies to the processing of personal data of individuals. FraudTrace AI's compliance position is straightforward:

* The data FraudTrace AI processes consists of fraud-actor identifiers (UPI VPAs) sourced from publicly observable fraud sites and intelligence feeds — not personal data of bank customers or payment users.
* FraudTrace AI does not act as a **Data Fiduciary** under DPDP for any of your customers' personal data, because it never receives or stores that data.
* You do not need to obtain your customers' consent for FraudTrace API calls, because you are not sharing your customers' personal data with FraudTrace.

<Tip>
  Share this page with your Data Protection Officer or Legal team when completing your DPDP Act compliance review for third-party processors. The key finding is that FraudTrace AI does not process personal data of your customers, removing it from the scope of most DPDP obligations that would apply to a data processor relationship.
</Tip>

***

## Audit Logs

Every API request your system makes to FraudTrace AI is recorded in an **immutable audit log** that includes:

* The timestamp of the request
* The API key identifier used (not the key value itself)
* The endpoint called
* The response status and fraud signal returned

Logs are tamper-evident and retained for compliance purposes. If you need access to your request logs — for example, for an internal audit, a regulatory inspection, or an incident investigation — contact [support@fraudtraceai.com](mailto:support@fraudtraceai.com) with your account details and the relevant date range.

***

## Evidence Retention

Screenshot archives and other evidentiary artefacts associated with a fraud cluster are retained for as long as the cluster remains active and relevant to ongoing fraud detection. When a fraud cluster is retired, associated artefacts are reviewed for retention or deletion based on the then-current retention policy.

***

## API Key Management

Your API key is the credential that authenticates your integration. Keep it secret — do not commit it to source control or expose it in client-side code.

If you believe your key has been compromised, or if you want to rotate it as part of a routine security review, contact [support@fraudtraceai.com](mailto:support@fraudtraceai.com). Key rotation is handled immediately: your new key is issued and the old key is **invalidated at once**, with no grace period.

<Warning>
  Any in-flight requests using the old key at the moment of rotation will fail with a `401 Unauthorized` response. Update your integration to use the new key before requesting rotation in a live environment.
</Warning>