Roshni Carelight for the mind
Sign in

Security Standards

Effective Date: 4 May 2026

1. Our Commitment

Roshni Care handles sensitive mental health data. We take that responsibility seriously. This page describes the technical and organisational controls we use to protect your personal data, including our obligations under the IT (SPDI) Rules 2011 and the DPDP Act 2023.

2. Encryption in Transit

  • All HTTP/S traffic uses TLS 1.2 or higher via Traefik on AWS EC2 (ap-south-1). Unencrypted HTTP connections are automatically redirected to HTTPS.
  • Video sessions use DTLS-SRTP for media encryption. Your video and audio stream is encrypted between your browser and Cloudflare’s media infrastructure — no one at Roshni Care can intercept session media.
  • TLS certificates are issued by Let's Encrypt and are automatically renewed before expiry. Certificate validity is monitored continuously.

3. Encryption at Rest

  • Postgres data is stored on an AWS EBS gp3 volume with AES-256 encryption at rest, managed by AWS. Data is not accessible outside the AWS virtual private network boundary.
  • All secrets — including the JWT signing secret, database credentials, API keys for Cloudflare RealtimeKit, ZeptoMail and Razorpay, and the Cloudflare API token — are stored in AWS SSM Parameter Store as SecureString parameters. They are never stored in source code, Docker images, or environment files.

4. Authentication and Session Security

  • Passwords are hashed using bcrypt at a minimum cost factor of 10 before storage. Plaintext passwords are never stored or written to logs at any point.
  • User authentication is handled via JSON Web Tokens (JWTs) with a defined expiry period. Expired tokens are rejected by the API.
  • Therapist accounts use a separate JWT role claim and are isolated from patient routes at the middleware level.

5. Infrastructure Security

  • The Platform is hosted on AWS EC2 in the ap-south-1 region (Mumbai, India), keeping all data within Indian territory.
  • AWS security groups permit no inbound traffic at all. The application server reaches the internet only outbound, through a Cloudflare Tunnel, so the origin is not directly addressable from the internet.
  • Postgres is not internet-accessible. It binds to the host network interface and is accessible only from within the EC2 instance.
  • ECS (Elastic Container Service) provides container isolation. No session data crosses container boundaries.

6. Data Segregation

  • All session, booking, and journal data is scoped to the authenticated user's ID. Row-level queries use parameterised SQL to prevent cross-user data access.
  • Therapists can only access session data for users who are assigned to them.
  • The therapist backoffice portal is protected by a separate therapist JWT role and a dedicated middleware layer that rejects patient-role tokens.

7. Payment Security

  • No card data is processed or stored by Roshni Care. All payments are handled directly by Razorpay, which is PCI-DSS Level 1 certified.
  • Payment authenticity is verified on every webhook and callback using Razorpay HMAC-SHA256 signatures. Payments with invalid signatures are rejected.
  • Roshni Care stores only the Razorpay order ID and payment reference ID, not any card or bank account details.

8. Monitoring and Incident Response

  • Application errors are monitored via Sentry. Error reports are anonymised where possible and are used only for diagnosing technical issues.
  • In the event of a data breach, Roshni Care will notify affected users and the Data Protection Board of India within 72 hours, in accordance with Section 8(6) of the DPDP Act 2023.
  • Application logs are retained for 30 days. Logs do not contain plaintext passwords, card data, or session content.

9. SPDI Compliance

  • Mental health data (session history, mood journal entries, onboarding responses) is treated as Sensitive Personal Data or Information (SPDI) under the IT (SPDI) Rules 2011.
  • Access to SPDI is restricted to a strict need-to-know basis. Only the assigned therapist and, where legally required, the Grievance Officer may access identifiable SPDI.
  • Security practices are reviewed at least annually, and controls are updated when new threats or regulatory guidance emerge.

10. Responsible Disclosure

If you discover a security vulnerability in the Platform, we encourage responsible disclosure:

  • Email your findings to shivashish@roshni.care with the subject line "Security Vulnerability Report".
  • We aim to acknowledge all vulnerability reports within 3 business days.
  • Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it.
WhatsApp