Privacy policy · last updated 9 October 2026
Your data stays where you put it.
We do not sell it, share it for advertising, or use it for anything but providing the service you pay for.
The short version
Where it is kept
In the region you choose when you create a project, or in your own cloud. It is not moved without your instruction.
Whose it is
Yours. The people, groups, keys and records in your project belong to you, and you can export or delete them.
What we do with it
Run the service. No advertising, no sale, no sharing for anyone else’s purposes.
This website
No tracking or advertising cookies. It remembers your colour scheme in your own browser and nothing else.
Who to ask
[email protected], for access, correction, deletion, export, or a complaint.
This summary is a reading aid. The full text below is what governs, and where the two differ the full text counts.
Who we are
AuthFI (“we”, “us”) is AuthFI Private Limited (CIN U62099OD2026PTC054857), registered at 1502, Hazari Lane, Kataka, Odisha 753009, India. We provide an identity platform: sign-in, single sign-on, AI agent authorization, enforcement, and the related services described on this site.
This policy covers two things: this website, and the AuthFI service our customers use. For most of the personal data in the service our customer decides why and how it is used, and we process it on their instructions; for the account and billing details of our own customers, and for this website, we decide.
What we collect
Account details. When a company signs up or buys a plan we hold the names, work email addresses and phone numbers of the people who administer it, the company’s name and billing address, and its tax number where one is given.
Payment details. Payments are taken by our payment processor in its own window. We receive the result and a reference; we never receive or store card numbers.
Customer data in the service. The people, groups, roles, organizations, devices, AI agents, sign-in connections, keys and audit records a customer creates in its project. This belongs to the customer.
Records of use. Sign-ins, refusals and administrative changes are written to the customer’s own audit record. We also keep operational measurements (request counts, error rates, which features are used) to run and improve the service.
From this website. If you write to us, apply to the startup program or place an order, the details you send. The startup form and the order form open your own email app; nothing you type is stored on the page.
How we use it
- To provide the service a customer has asked for, and to keep it secure.
- To bill for it and to keep the accounts the law requires.
- To answer questions and requests for support.
- To detect and stop misuse, including attacks on our customers’ accounts.
- To tell customers about changes to the service or to these terms.
We do not sell personal data, use it for advertising, or use customer data to train models for anyone else.
Where it is kept
Every project is created in one region and stays there for its life. The people, sessions, keys and audit record of that project are stored in that region only.
- Virginia, USA, on Amazon Web Services (us-east-1).
- Mumbai, India, on Google Cloud (asia-south1).
- Your own cloud or data centre, on the Enterprise plan. In that case the data is on your infrastructure.
Account and billing records, and the routing that sends a request to the right region, are held by our control plane. Requests pass through our network provider’s edge locations worldwide on their way to a region; those locations do not store customer data.
We do not move a project’s data between regions unless the customer asks us to.
How we protect it
- Data is encrypted in transit and at rest.
- Each project signs with its own keys, held in the key service; no project can use another’s.
- Secrets a customer gives us for its connections are sealed on arrival and cannot be read back in the console.
- Access by our own staff to production systems needs a second sign-in step and is recorded.
- We keep no long-lived cloud credentials; our own access to cloud resources uses short-lived tokens.
No system is perfectly secure. If we learn of a breach that affects your data we will tell you without undue delay, and within the time the law requires. To report a vulnerability write to [email protected].
Who else handles it
We use other companies to run the service. Each handles only what its job needs:
- Amazon Web Services and Google Cloud, which host our regions.
- Cloudflare, which carries traffic to the regions and protects against attacks.
- Our payment processor, which takes payments.
- Email and text-message carriers, which deliver the sign-in codes, invitations and notices a customer’s project sends.
We do not give customer data to anyone for marketing, analytics or advertising. We may disclose data where the law requires it, and we will tell the customer first unless the law forbids that.
How long we keep it
Customer data is kept for as long as the customer’s account is open. A customer can delete people, projects or its whole account from the console.
When an account is closed its data is deleted within 30 days. Audit records may be kept for up to 90 days after that, and billing and tax records for as long as the law requires.
Your rights
Wherever you are, you can ask us for a copy of the personal data we hold about you, to correct it, to delete it, or to export it in a form another service can read.
In India, under the Digital Personal Data Protection Act, you may also withdraw consent, nominate someone to act for you, and complain to us and then to the Data Protection Board.
In the European Union and the United Kingdom, under the GDPR, you may also object to or restrict our processing, and complain to your data protection authority.
If you are a user of one of our customers’ applications, that customer decides how your data is used: please ask them first, and we will help them answer. For everything else write to [email protected]. We answer within 30 days.
Children
AuthFI is sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 for our own purposes.
Changes to this policy
We may update this policy. For a change that matters we will tell customers by email or in the console at least 30 days before it takes effect, and the date at the top of this page will change.
Contact and complaints
Privacy questions, requests and complaints: [email protected]. Security reports: [email protected]. Anything else: [email protected].
By post: AuthFI Private Limited (CIN U62099OD2026PTC054857), registered at 1502, Hazari Lane, Kataka, Odisha 753009, India.