Compliance & Data Residency
DPDP Act 2023 compliance, India data residency, MeitY alignment, and enterprise DPA.
DPDP Act 2023
Tensor Machine is designed from the ground up for compliance with India's Digital Personal Data Protection Act 2023:
Retention is opt-in, not opt-out
Content logging is off unless your organisation turns it on. While it is off, the router sets the gateway's disable-content-logging flag on every request: your prompts and completions are held only for as long as it takes to serve the response, and are never written to our databases.
Turning it on is an explicit, org-scoped decision (query_log_opt_in, settable by an org admin),
so that teams who need query logs for their own audit or SIEM pipeline can have them. There is no
switch you have to remember to turn off — forgetting to configure anything is the safe outcome.
Two things hold either way:
- We do not train or fine-tune any model on your data. Not with logging on, not with it off.
- We do not sell your data, and we disclose it to no one beyond the model provider that serves your request.
That last clause is the honest one. The provider serving a request necessarily receives your prompt — that is what inference is. Which providers are permitted to serve you is constrained by the residency guardrail below; that is a real narrowing, but it is not the same claim as "nobody else ever sees your prompt", and we will not make the latter.
India data residency
All inference runs on servers physically located in India:
| Region | Data centre | Purpose |
|---|---|---|
| Primary | Mumbai, India | All inference workloads |
| Secondary | Hyderabad, India | Failover and redundancy |
Your data never leaves Indian jurisdiction. We do not route requests through US or EU infrastructure.
Consent and purpose limitation
As an API service, Tensor Machine processes data on behalf of your application ("Data Fiduciary" under DPDP). You are responsible for obtaining user consent for the specific purpose of AI processing. Our Data Processing Agreement formalises this relationship.
MeitY alignment
Tensor Machine's infrastructure is aligned with Ministry of Electronics and Information Technology (MeitY) guidelines for cloud services used by Indian enterprises, including:
- Cloud Security Guidelines for Government and Public Sector (where applicable)
- Meity's Trusted Telecom Portal for sovereign data handling
- IndiaAI Mission compliance readiness
RBI data localisation
For financial services customers, Tensor Machine supports RBI data localisation requirements. All data processed through our API remains within India's borders, satisfying RBI's guidelines on storage of payment system data.
CERT-In
We maintain an active incident response process aligned with CERT-In (Computer Emergency Response Team India) requirements, including:
- 6-hour breach notification capability
- Logs retention for 180 days (infrastructure-level, not application-level prompt data)
- Designated security contact: security@tensormachine.ai
Security certifications
| Certification | Status |
|---|---|
| ISO 27001 | Not yet certified |
| SOC 2 Type II | Not yet certified |
| DPDP Consent Manager | Aligned |
Data Processing Agreement (DPA)
Enterprise customers can request a signed DPA for procurement compliance. The DPA covers:
- Controller / processor relationship under DPDP Act
- Sub-processor list and notification obligations
- Data deletion timelines
- Audit rights
Contact: compliance@tensormachine.ai
GDPR note
Tensor Machine is built for Indian jurisdiction (DPDP Act 2023) and is not a GDPR-regulated entity. If your workloads require EU data residency or GDPR processing terms, Tensor Machine is not the right fit today.
Claude CLI
Point Anthropic's claude command-line tool at your Tensor Machine workspace with two environment variables, so its requests run on India-resident inference.
Single Sign-On (SAML)
Route your verified email domains through your enterprise identity provider (Okta, Microsoft Entra ID, Google Workspace) with SAML — test, activate, then optionally enforce.