Enterprise Trust

Security & Data Protection

Vansera AI treats your guests' data with the same care as a premium fine-dining establishment. Here is exactly how we secure our infrastructure.

The Short Version: We are fully compliant with India's Digital Personal Data Protection (DPDP) Act, 2023. Your customer data is never used to train AI models. All data is encrypted in transit using TLS 1.2+. Audio streams are processed entirely in memory and discarded instantly. Our servers are hardened against attacks and located entirely within India.

1. No Data Training

The foundational models we use (including Llama 3.3 70B and Sarvam Bulbul v3) are accessed via enterprise APIs. Zero customer data, conversation transcripts, or booking details are used to train these models. Your guest list remains strictly yours.

2. Ephemeral Audio Processing

When a customer speaks to Ishita over the phone, the audio is processed in real time and converted to text. We do not save or record the audio files. The raw voice stream is discarded from memory the moment the call ends.

3. Compliance with the DPDP Act 2023

Vansera acts as a Data Processor on behalf of your restaurant (the Data Fiduciary). We comply strictly with the DPDP Act:

Purpose Limitation: We only process data necessary to handle the reservation and notify you.
Data Minimization: We don't ask for intrusive details. Only the guest's name, phone number, and party size are collected.
Right to Erasure: If a guest requests their data be deleted, our systems support full deletion within 30 days.

4. Infrastructure & Network Security

Our application is built with defense-in-depth architecture:

Encryption in Transit: All traffic between the caller, our servers, and your Google Sheets is encrypted using TLS 1.2 or higher.
Data Residency: Our core application servers and primary databases are hosted in Bangalore, India.
Rate Limiting: All our APIs are strictly rate-limited per-IP to prevent brute-force attacks and abuse.
Webhook Signatures: Every incoming WhatsApp message or phone call from our telephony carriers is verified via HMAC cryptographic signatures. If an attacker tries to spoof a booking, the request is dropped.

5. Strict Access Controls

We operate on a principle of least privilege. Only the two named founders of Vansera have shell access to the production servers, gated by SSH keys. The Client Portal uses constant-time HMAC-signed session cookies that are Secure and HttpOnly.

6. Daily Encrypted Backups

We take daily encrypted snapshots of our entire infrastructure to ensure your bookings are safe against any catastrophic failure. Additionally, all bookings are simultaneously written to a Google Sheet that you own and control, ensuring you always have a real-time, independent copy of your data.