# Compliance & Data Residency
Source: https://docs.tensormachine.ai/compliance

## DPDP Act 2023

Tensor Machine is designed from the ground up for compliance with India's **Digital Personal Data Protection Act 2023**:

### Retention is opt-in, not opt-out

Content logging is **off unless your organisation turns it on**. While it is off, the router sets
the gateway's disable-content-logging flag on every request: your prompts and completions are held
only for as long as it takes to serve the response, and are never written to our databases.

Turning it on is an explicit, org-scoped decision (`query_log_opt_in`, settable by an org admin),
so that teams who need query logs for their own audit or SIEM pipeline can have them. There is no
switch you have to remember to turn *off* — forgetting to configure anything is the safe outcome.

Two things hold either way:

- **We do not train or fine-tune any model on your data.** Not with logging on, not with it off.
- **We do not sell your data, and we disclose it to no one** beyond the model provider that serves
  your request.

That last clause is the honest one. The provider serving a request **necessarily receives your
prompt** — that is what inference is. Which providers are permitted to serve you is constrained by
the residency guardrail below; that is a real narrowing, but it is not the same claim as "nobody
else ever sees your prompt", and we will not make the latter.

### India data residency

All inference runs on servers physically located in India:

| Region | Data centre | Purpose |
|--------|-------------|---------|
| Primary | Mumbai, India | All inference workloads |
| Secondary | Hyderabad, India | Failover and redundancy |

Your data never leaves Indian jurisdiction. We do not route requests through US or EU infrastructure.

### Consent and purpose limitation

As an API service, Tensor Machine processes data on behalf of your application ("Data Fiduciary" under DPDP). You are responsible for obtaining user consent for the specific purpose of AI processing. Our [Data Processing Agreement](#dpa) formalises this relationship.

---

## MeitY alignment

Tensor Machine's infrastructure is aligned with **Ministry of Electronics and Information Technology (MeitY)** guidelines for cloud services used by Indian enterprises, including:

- Cloud Security Guidelines for Government and Public Sector (where applicable)
- Meity's Trusted Telecom Portal for sovereign data handling
- IndiaAI Mission compliance readiness

---

## RBI data localisation

For financial services customers, Tensor Machine supports **RBI data localisation requirements**. All data processed through our API remains within India's borders, satisfying RBI's guidelines on storage of payment system data.

---

## CERT-In

We maintain an active incident response process aligned with **CERT-In (Computer Emergency Response Team India)** requirements, including:

- 6-hour breach notification capability
- Logs retention for 180 days (infrastructure-level, not application-level prompt data)
- Designated security contact: security@tensormachine.ai

---

## Security certifications

| Certification | Status |
|---------------|--------|
| ISO 27001 | Not yet certified |
| SOC 2 Type II | Not yet certified |
| DPDP Consent Manager | Aligned |

---

## Data Processing Agreement (DPA)

Enterprise customers can request a signed **DPA** for procurement compliance. The DPA covers:

- Controller / processor relationship under DPDP Act
- Sub-processor list and notification obligations
- Data deletion timelines
- Audit rights

Contact: [compliance@tensormachine.ai](mailto:compliance@tensormachine.ai)

---

## GDPR note

Tensor Machine is built for Indian jurisdiction (DPDP Act 2023) and is not a GDPR-regulated entity. If your workloads require EU data residency or GDPR processing terms, Tensor Machine is not the right fit today.