How Lekha protects your data

Architecture controls (implemented)

• Encryption in transit — HTTPS everywhere; HSTS at the edge.
• Row-level isolation — every user-data table enforces Row Level Security; organisation data is scoped to membership at the database layer, not just in application code.
• Role-based access — owner / admin / member / viewer roles enforced twice: in the application and by database triggers, so a bypassed UI cannot escalate anyone.
• Private storage — uploaded files and executed copies live in private buckets; downloads go through a server proxy that re-checks membership on every fetch instead of minting long-lived links.
• Tamper-evident audit log — organisation activity is written to a hash-chained, append-only log with a verification routine; editing history breaks the chain visibly.Verification runs daily (2026-08-14); no organisation activity has been logged yet, so there is no chain to attest. The attestation will appear here once there is.
• Secrets stay server-side — no API keys or service credentials are ever shipped to the browser.
• Abuse limits — rate limiting and a daily AI budget on every AI-backed endpoint.

Data protection (implemented)

• India-resident database — production data lives in Mumbai (ap-south-1), chosen deliberately for DPDP alignment.
• Your document contents never train or prompt AI — the values you type into templates are never sent to any AI model and never embedded into the search index. This is a structural restraint, not a policy promise.
• Deletion that deletes — account deletion runs a database routine that removes your data, reachable from the Privacy Center.
• Grievance contact — support@elevana.guru, with the redressal process published in the Privacy Center.

Sub-processors

Services that process data on Lekha's behalf:

• Supabase — database and file storage (Mumbai region)
• Vercel — application hosting and edge network
• OpenAI and Anthropic — AI inference (never receives your document field values)
• Resend — transactional email
• Google Cloud Vision — OCR, only when image extraction is used

Responsible disclosure

Found a vulnerability? Email support@elevana.guru with enough detail to reproduce it. We will acknowledge within 3 working days, keep you informed, and credit you if you wish. Please avoid accessing other people's data, degrading the service, or public disclosure before we have had a reasonable chance to fix the issue. Machine-readable contact: /.well-known/security.txt.

Not yet — stated plainly

• No independent penetration test has been performed. The controls above are self-implemented and self-assessed. An external test is on the roadmap; until it happens, this page does not claim it.
• No SOC 2 or ISO 27001 certification. The audit-log, access-control and isolation machinery is built with those control families in mind, but nobody independent has certified it.
• Backups are the platform provider's managed backups. We have not yet run an independently verified restore drill.
• Legal review is in progress, not complete. Templates are honestly labelled Beta until a named advocate has reviewed them — see the label on every template page.