Answer your vendor review
from this page.
You have a questionnaire to complete, an architecture to assess, and a DPDP position to verify. Below is our answer for each domain — including the four where our answer is "not yet," with a date.
If something here is not enough to close a row on your assessment, the security pack has the detail, and an engineer will take the call rather than an account manager.
One request, and most of your questionnaire is answered
So you know exactly what you are asking for before you submit a vendor review request.
| Included in the Security Pack | Specification & Scope Details |
|---|---|
| ISO 9001, 27001 and 27701 certificates | Official registrar certificates with full scope statements and accreditation seals (valid to September 2028). |
| Architecture and tenancy note | PostgreSQL schema isolation model, connection pool validation, identity planes, and KMS storage tiers. |
| Authorisation model document | Persona, module, 21-verb vocabulary and row-level data scope; the full separation-of-duties matrix. |
| Data protection note | Application-layer encryption at rest with blind indexes, DSAR operational handling, retention model, audit ledger design. |
| Sub-processor list | Complete declared list: AWS India (Hosting & Storage), Exotel (SMS Muster), SendGrid (Transactional Email), Sentry (Error Telemetry). |
| Data Processing Addendum template | Standard counsel-reviewed DPA aligned with the Digital Personal Data Protection (DPDP) Act 2023. |
| Backup and recovery note | Backup verification tooling, weekly scratch DB assertion mechanics, and disaster recovery architecture. |
| Penetration test executive summary | Scheduled third-party external VAPT executive summary (Annual assessment scheduled Q4 2026). |
| Completed CAIQ v4 questionnaire | Pre-filled Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ v4). |
Supplied under mutual NDA · Dispatch within 2 working days
Separated at the database layer, not by a column
Every customer has a private PostgreSQL schema. Every tenant-scoped table — employee records, payslips, documents, audit ledgers, tickets — lives inside it. There is no shared table with a customer-id column that a missing filter could leak across.
Verified per request
A tenant user authenticates with a tenant-scoped token carrying a schema claim, verified against the DB connection's search_path on every request.
Two identity planes
Platform staff and tenant users are completely separate models with separate auth paths. Platform staff reach tenants only via explicit cross-tenant grants.
No cross-schema FKs
References between applications inside a tenant use loose integer identifiers rather than foreign keys, preventing cross-schema constraint leaks.
Physically separate desk
Our internal customer support ticketing desk is a physically separate application in the public schema, so grievances are never stored in shared tables.
Storage Tiers
| Storage Tier | Isolation & Encryption Model |
|---|---|
| Shared Bucket | Per-tenant key-prefix isolation under a tenant-aware storage backend, server-side encrypted (SSE-S3). |
| Dedicated Bucket | A separate physical bucket per tenant, your own AWS KMS customer-managed key, and optional object-lock. Gives you a crypto-shred exit: schedule the key for deletion and the bucket is permanently unreadable without touching a row. |
Our global-admin role bypasses tenant permission checks by design, for platform operations, schema migrations, and incident response. This role is restricted to 3 named senior infrastructure engineers, requires hardware MFA, temporary break-glass elevation approval, and immutable session audit logging. We state this explicitly because a reviewer will discover it, and a vendor stating it alongside its compensating controls is trustworthy.
Hosting & Data Residency: Amazon Web Services (AWS), Asia Pacific (Mumbai) region (ap-south-1). 100% Indian data residency.
Enterprise SSO, and the version-one bounds
Standards-based federated identity wired into enterprise directories.
| Capability | Status & Architectural Safeguard |
|---|---|
| SAML 2.0 | Service Provider (SP) initiated, strict mode, one IdP configuration per tenant. Supports Microsoft Entra ID (Azure AD), Okta, Google Workspace, Ping. |
| OIDC | Supported, sharing the same identity chokepoint as SAML — so no-JIT, inactive-user refusal, employee-profile gating and auditing hold identically. |
| SCIM | Automated user provisioning and deprovisioning, with deprovision semantics directly wired into the employee offboarding/leaver process. |
| Multi-factor (MFA) | TOTP authenticator app supported for non-SSO local administrative logins. |
| Password policy | Minimum length, complexity, expiry, history, and tier presets — enforced at three independent chokepoints. |
| API rate limiting | Tenant-scoped rate limits, so one tenant’s runaway integration cannot exhaust another tenant’s rate window. |
Documented version-one bounds on our SAML implementation: no Single Logout (SLO), and no InResponseTo tracking. Both are scheduled on our roadmap for Q1 2027. We list them here rather than waiting for your questionnaire to uncover them during integration testing.
Policy Design Detail: Password expiry counts from each account's next change rather than from a global date, so tightening policy on an existing tenant cannot lock every corporate user out simultaneously.
Four layers, and roughly 240 permissions that are derived rather than stored
Persona → module → action verb → data scope.
| Authorisation Layer | Architectural Implementation |
|---|---|
| 1. Persona | A bundle of grants assigned as a unit. 30 system packs ship pre-seeded, so administrators do not assemble roles from raw permissions and risk privilege creep. |
| 2. Module | One of 16 first-class product areas (Payroll, Statutory, Expense, Attendance, e-Vault, etc.). |
| 3. Action Verb | A single canonical 21-verb vocabulary: view, create, edit, delete, submit, approve, reject, cancel, reverse, lock, unlock, upload, download, export, print, configure, run_process, schedule, disburse, approve_payment, audit. |
| 4. Data Scope | Row-level narrowing by scope type (legal entity, site, cost centre, contractor) plus attribute conditions. |
Three gates that must agree
Navigation visibility, route guards, and API permissions are enforced independently. Automated CI test suites assert all three stay in lockstep, preventing URL bypass bugs.
Four-eyes separation on money
Four verbs held by separate roles: run_process, approve, approve_payment, disburse. A person-level check blocks the payroll approver from approving payment.
Vendor scoping is unconditional: a labour contractor logged into the vendor portal reaches strictly their own roster, deployments and documents. It is an architectural invariant, not a toggle an administrator can disable.
Encrypted where it matters, and still searchable
Application-layer encryption for high-risk identity and financial attributes.
Application-layer encryption with blind indexes
Sensitive identifiers are encrypted at the application layer before reaching PostgreSQL: UAN, ESIC number, PAN, passport, driving licence, voter ID, landlord PAN, and bank accounts, alongside integration credentials and webhook secrets.
The technical nuance: Application encryption is non-deterministic (AES-256-GCM). Because standard DB uniqueness constraints fail on non-deterministic ciphertext, columns requiring equality search or uniqueness carry blind indexes (HMAC-SHA256). Key material is injected via environment secrets; the application refuses to boot outside debug mode if keys are missing.
| Data-Principal Right | System Implementation |
|---|---|
| Access & Export | First-class tenant export with identifiers decrypted (an export with masked fields fails compliance). |
| Right to Erasure | Managed via an Erasure Register rather than a naive delete button; requires HR justification if legally refused (e.g. statutory 5-year retention). |
| Configurable Retention | Category × document type × jurisdiction → retention schedule in months, resolved at upload. |
| Legal Hold | Overrides automated retention schedules until explicit administrative release. |
| Append-Only Audit Ledger | Tamper-evident, hash-chained ledger. Holds zero personal data, so it can be produced in court without creating a privacy leak. |
On DPDP, stated accurately:We do not claim to be "fully DPDP compliant" — nobody is, and the Rules' substantive compliance date is 13 May 2027. What we have built is the complete technical machinery: purpose-bound consent, retention as code, first-class erasure, and Indian data residency.
Off by default, and correct with it off
Four non-negotiable architectural principles for generative and assistive models.
It drafts, summarises, scores, and flags. A human approves the claim, the rating, the hire, and the payment. No AI action is autonomous on the money path or in an employment decision.
Each capability is built over a complete rule-based baseline that produces a correct result with AI switched off. The model enriches; it is never load-bearing.
You choose which AI features are enabled. Provisioned with AI disabled entirely, you lose zero statutory or operational functionality — only convenience.
All model dispatch runs through a single audited chokepoint rather than each module calling external APIs independently, enforcing tenant policy uniformly.
"Does our employee data reach a third-party model?" If AI features are enabled, yes — dispatch calls a third-party LLM provider. The identifier-redaction layer that will strip structured identifiers prior to dispatch is designed and currently in testing. Until it ships, our recommendation for security-sensitive tenants is straightforward: we provision you with AI disabled. You lose no functionality because of Principle 2.
What is built, and what is not yet proven
Disaster recovery tooling that prioritizes database integrity over optimistic assertions.
Refuses small dumps
Backup automation refuses to keep dumps under 1 KiB, catching silent cron failures that write empty files.
Weekly restore assert
Automated restore testing into a scratch PostgreSQL instance with row-count verification.
Offsite mirroring
Cross-zone encrypted mirroring with SHA-256 checksum readbacks on all database snapshots.
Freshness alerting
Automated telemetry alerts on backup age to prevent silent snapshot lag.
We do not yet publish formal RPO or RTO contractual commitments, because neither has been certified by a formal third-party drill. Tooling and weekly scratch restores exist; our comprehensive disaster recovery drill is scheduled for Q4 2026. Until complete, the honest answer to an RPO question is "we have the tooling and are drilling it," and that answer is not dressed up. Target availability: 99.9% general uptime, with a priority pay-window standby commitment.
Invariants enforced at build time, not by convention
Engineering practices that ensure security controls are tested in code rather than left to developer memory.
Architectural tests
CI build asserts tenant search-path safety and blocks any code introducing cross-schema query leakage.
Service-layer ownership
Statutory and business logic lives in independently unit-tested services, completely separate from HTTP views.
Invariant-named suites
484 automated tests on contract labour alone, naming the exact statutory control defended when a failure occurs.
Secrets never returned
API keys and integration secrets are write-only. Endpoints return has_secret: true booleans, never plaintext.
Known gap: The ATS inbound webhook signing secret is currently re-readable and lacks a zero-downtime rotation endpoint. Rotation is scheduled for remediation in Q1 2027.
Secure SDLC: Mandatory branch protection, static analysis (SAST) and dependency vulnerability scanning in CI, dual-engineer code reviews, and separation of deployment privileges.
What we hold, and what we do not
Independent audits verified against international management standards.
| Standard / Framework | Status | Certificate & Audit Reference |
|---|---|---|
| ISO 9001:2015 | Held | IN/19920701/2497, ICV Assessments (Valid to 29/09/2028). EGAC accredited. |
| ISO 27001:2022 | Held | IN/48720702/6157, ICV Assessments (Valid to 29/09/2028). EGAC accredited. |
| ISO/IEC 27701:2019 | Held | MQCPF72H25, MQCI UK (Valid to 25/09/2028). Privacy Information Management. |
| SOC 2 Type II | Not held | Observation window planned for FY 2027; report anticipated late 2027. |
| Third-party VAPT | Scheduled | Annual external grey-box penetration test scheduled Q4 2026 with CERT-In empaneled auditor. |
All certificates are issued to Finnovo Tech Functional Private Limited, the parent company of yfy®.
The section that should make you trust the rest of this page
Every vendor page has a security section. Almost none has this one. Here is our complete list of gaps in the domains you assess, with our exact position on each.
| Assessed Domain / Gap | Our Engineering & Operational Position |
|---|---|
| SOC 2 Type II | Not held. Target report date late 2027. ISO 27001:2022 and 27701:2019 held currently. |
| Third-party penetration test | Annual external VAPT scheduled for Q4 2026. Executive summary will enter the pack. |
| Published contractual RPO / RTO | Tooling and weekly scratch restores active; formal certified drill scheduled Q4 2026. |
| AI identifier redaction | Designed and in testing, not shipped. Recommendation for security-conscious tenants: AI disabled. |
| SAML Single Logout & InResponseTo | Not in version one. Target release Q1 2027. |
| Webhook secret rotation (ATS) | Re-readable, rotation endpoint scheduled Q1 2027. |
| Native mobile applications | In progress. Highly responsive, install-free mobile-first browser surfaces active today. |
| Multi-country data residency | Out of scope. India only, deliberately. |
| On-premise deployment | Not offered. Equivalent security is our Dedicated Bucket tier with your own KMS key. |
We publish this because you are going to find it. A vendor who discloses their own version-one limitations is a vendor whose other claims you can weigh. We would rather be assessed accurately than approved on a misunderstanding.
The rows that usually take three emails
Get the pack, then talk to an engineer
Request the security pack and we will send it under mutual NDA within 2 working days. If a row on your assessment still is not closed, the follow-up call is with an engineer who built the system — not an account manager reading from a sheet.