Trust

Security at BizlumoAI

Your employees' personal data is on our servers. Here's exactly how we protect it — no marketing fluff, just the technical specifics.

Last updated: 06 May 2026
The summary All data in India (AWS Mumbai). TLS 1.3 in transit, AES-256 at rest. Face data stored as one-way hashes. Razorpay handles payments (we never see card data). Daily encrypted backups, 30-day retention. Responsible disclosure rewards available.

Infrastructure

We host on Amazon Web Services in the Mumbai region (ap-south-1). No customer data leaves Indian jurisdiction.

Specifically:

Encryption

In transit

All connections to BizlumoAI use TLS 1.3 (TLS 1.2 minimum, with modern cipher suites only). HTTP requests are redirected to HTTPS. HSTS is enabled with a 1-year max-age. Our certificates are issued by Amazon Certificate Manager and rotated automatically.

At rest

Database encrypted with AES-256 using AWS KMS-managed keys. S3 buckets use SSE-KMS encryption. Backups are encrypted before being written to backup storage.

Application-level encryption

Sensitive fields (Aadhaar last-4, PAN, bank account number) are additionally encrypted at the application layer using a separate key, so even a database breach wouldn't expose them in plaintext.

Access control

Customer side

Internal access

Face data — how it works

We never store raw face images on our servers. Here's the flow:

  1. Employee stands in front of the kiosk tablet
  2. Camera captures face image (stays on device)
  3. On-device ML model converts image to a 128-dimension numerical embedding (a face "fingerprint")
  4. Only the embedding is transmitted to our servers (over TLS 1.3)
  5. Original image is discarded immediately
  6. Embedding is stored with AES-256 encryption

The embedding is a one-way hash. There's no mathematical way to reverse it back into a face image. If our database were ever compromised, attackers would have a list of meaningless 128-number vectors — they couldn't reconstruct your employees' faces.

Liveness detection runs at recognition time to prevent photo/video spoofing — you can't fool the kiosk by holding up a phone screen with someone's photo.

Payments

All payments are processed through Razorpay, which is PCI-DSS Level 1 certified. We never see your card data — Razorpay handles tokenisation and we only receive a payment status callback.

We store the Razorpay subscription ID and the last 4 digits of your card (for display purposes only). No CVV, no full card number, no expiry date.

Monitoring & alerting

Backups & disaster recovery

Incident response

If a security incident occurs that affects customer data, we will:

  1. Investigate and contain within 24 hours
  2. Notify affected customers within 72 hours via email (per DPDP Act 2023 requirements)
  3. File required notifications with the Data Protection Board of India
  4. Publish a public post-mortem within 30 days, including timeline, root cause, and corrective actions

Subscribe to security notifications by emailing security-list@bizlumoai.com with subject "subscribe". You'll get notified of any security advisory we publish (we hope this list stays empty).

Compliance & certifications

We're a young company. We don't have certifications that take 18+ months to achieve. We do have the underlying controls in place; certifications will follow as we scale.

Responsible disclosure

Found a security vulnerability? Report it to security@bizlumoai.com. We commit to:

We don't have a bug bounty program yet, but we offer monetary rewards for valid critical/high severity findings on a case-by-case basis (typical range ₹10,000–₹1,00,000 depending on severity and report quality).

Out of scope

Need a copy of this page as a PDF for vendor security review? Email security@bizlumoai.com — we'll send a signed PDF version with our security questionnaire.