> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudtraceai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FraudTrace AI: Security, Compliance & Data Controls

> FraudTrace AI's enterprise security controls, compliance status (SOC 2, ISO 27001, DPDP 2023, RBI CSF), and India-only data residency.

FraudTrace AI is built specifically for regulated financial institutions — banks, PSPs, wallets, and fintechs — that require thorough third-party vendor security documentation before onboarding any API provider. This page summarises our compliance posture, technical controls, and how our platform is designed to support your internal information security reviews.

## Compliance Posture

Every control listed below applies to the FraudTrace AI platform in its entirety, including the API, infrastructure, internal tooling, and data pipelines.

<CardGroup cols={2}>
  <Card title="SOC 2 Type II" icon="shield-check">
    **In Progress — Q3 2026 target**

    Audit scope covers the Security, Availability, and Confidentiality trust service criteria. Pre-audit controls are in place and operating.
  </Card>

  <Card title="ISO 27001" icon="certificate">
    **Controls aligned — certification in scope for 2026**

    Our information security management practices are aligned with ISO 27001 requirements. Formal certification is planned for 2026.
  </Card>

  <Card title="DPDP Act 2023" icon="scale-balanced">
    **Compliant**

    FraudTrace AI does not collect or process the personal data of bank customers or payment recipients. See [Data Handling](/security/data-handling) for a full breakdown.
  </Card>

  <Card title="RBI Cyber Security Framework" icon="building-columns">
    **Aligned**

    API design, access controls, and audit logging are aligned with RBI guidelines for third-party API integrations at regulated banks and NBFCs.
  </Card>

  <Card title="Data Residency" icon="location-dot">
    **India only — AWS Mumbai (ap-south-1)**

    All data is stored and processed exclusively within Indian cloud infrastructure. No data leaves Indian jurisdiction.
  </Card>

  <Card title="PII Minimisation" icon="eye-slash">
    **By design**

    Only fraud-actor UPI VPAs are indexed. FraudTrace never stores victim or bank-customer personal data at any point in the pipeline.
  </Card>
</CardGroup>

<Tip>
  If your information security team is conducting a third-party vendor risk assessment, share this page and the [Data Handling](/security/data-handling) page directly. Together they cover the most common questionnaire categories: data residency, PII handling, encryption, access controls, and compliance certifications.
</Tip>

***

## Technical Security Controls

The following controls are active across all environments and apply to every API request you make.

### Encryption

| Layer                    | Standard                                                                  |
| ------------------------ | ------------------------------------------------------------------------- |
| API traffic (in transit) | TLS 1.3 — enforced on all endpoints; older protocol versions are rejected |
| Data at rest             | AES-256 — applied to all databases and object storage                     |

### Authentication and Access

FraudTrace AI uses **Bearer token authentication**. Your API key is included in the `Authorization` header of every request. Keys can be rotated on demand — contact [support@fraudtraceai.com](mailto:support@fraudtraceai.com) to request a rotation. The old key is invalidated immediately upon rotation.

Internal systems use **role-based access control (RBAC)**. No engineer has standing write access to production data stores; access is granted on a just-in-time basis with a full audit trail.

### Audit Logging

Every API request you make — including the full request payload and the response — is captured in an **immutable audit log**. Logs are timestamped, tamper-evident, and retained for compliance purposes.

<Note>
  FraudTrace API response objects — including the `confidence_score`, `cluster_id`, fraud category, and evidence source references — are designed to be stored directly in your own systems as part of your regulatory audit trail. Regulators and internal audit teams can then trace any mule-account action back to the underlying API evidence.
</Note>

### Infrastructure and Perimeter

* **Rate limiting** is enforced on all API endpoints to prevent abuse and credential-stuffing attacks.
* **Anomaly detection** monitors for unusual request patterns across all client accounts.
* Infrastructure is hosted on **AWS Mumbai (ap-south-1)** with no cross-region data replication outside India.

***

## Responsible Disclosure

If you discover a potential security vulnerability in FraudTrace AI's API, infrastructure, or documentation, please report it responsibly. The FraudTrace security team reviews all incoming disclosures promptly and will keep you informed throughout the investigation.

**Contact:** [security@fraudtraceai.com](mailto:security@fraudtraceai.com)

Please include a clear description of the issue, steps to reproduce, and any supporting evidence (screenshots, request/response logs). We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.