Data Processing Agreement – Evidaro
Between the Customer named in the order form or pilot agreement ("Customer", the data fiduciary) and SCUTI MARKETPLACE INDIA (OPC) PRIVATE LIMITED, CIN U47912UP2025OPC218793, trading as Evidaro ("Evidaro", the data processor). Forms part of the Terms of Service or order form.
1. Scope
| Subject matter | Providing the Evidaro compliance-operations software |
| Duration | The term of the agreement plus the return/deletion period in clause 9 |
| Nature and purpose | Storage, extraction, search, comparison, reporting and assistant answers over Customer Data, on Customer's instructions |
| Data principals | Customer's personnel and users; directors, officers, shareholders, employees, customers and counterparties of Customer's clients |
| Personal data | Names, contact details, identifiers (e.g. DIN, PAN where present in documents), roles, signatures and other data contained in documents and records Customer uploads |
Customer is responsible for having a lawful basis for the data it provides.
2. Instructions
Evidaro processes Customer personal data only on Customer's documented instructions (these terms and Customer's use of the product), unless the law requires otherwise – in which case Evidaro will tell Customer first where permitted.
3. Personnel
Only personnel who need access to operate or support the service have it; they are bound by confidentiality. Access to the AWS account is logged (AWS CloudTrail); actions in the application are recorded in its audit log. Planned: logging of direct database sessions.
4. Security measures (Annex A)
Evidaro maintains the measures in Annex A and will not materially reduce them.
5. Data location
Customer Data is stored and processed in India – AWS Asia Pacific (Mumbai), including backups, logs and AI processing. The application is served directly from Mumbai, its functions are prevented from calling AWS outside the region, and only in-region AI models are permitted. Customer Data does not leave India, except as Customer itself directs (for example, files its users download or emails they send). Evidaro will not move Customer Data outside India without Customer's prior written consent.
6. Sub-processors
Current list (Annex B). Evidaro will give 30 days' notice of a new sub-processor; Customer may object on reasonable grounds, and if not resolved, terminate the affected service. Evidaro remains responsible for its sub-processors.
7. Personal data breach
Evidaro will notify Customer without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting Customer Data, with what is known, and update as facts emerge – so Customer can meet its own deadlines (including CERT-In's 6 hours and its regulators'). Evidaro will itself report to CERT-In where the CERT-In directions require.
8. Assistance, audits and regulators
- Evidaro assists Customer, at reasonable cost, with data principals' requests, impact assessments and regulator queries.
- Customer (or its auditor), and Customer's regulators (e.g. SEBI, RBI), may audit Evidaro's compliance with this agreement on reasonable notice. Evidaro will provide its latest security assessment (e.g. VAPT summary, ISO 27001 certificate once obtained) on request.
9. Return and deletion
At the end of the service Customer may export its data for 30 days; Evidaro then deletes it from the live systems within 30 days and from backups within 35 days (backup retention is 7 days for the database), unless the law requires retention.
10. Liability
As in the Terms of Service.
Annex A – Security measures (as implemented)
- Hosting: AWS Asia Pacific (Mumbai); application on AWS Lambda behind a regional API Gateway in Mumbai; PostgreSQL on Amazon RDS (encrypted at rest); documents on Amazon S3 (encrypted at rest, versioned, public access blocked, TLS-only).
- Isolation: every customer's records tagged by organisation and enforced by PostgreSQL row-level security; the application connects with a role that cannot bypass it.
- Access: role-based permissions (administrator, analyst, reviewer, control owner, client contributor, read-only auditor), optional per-company scoping; passwords stored as salted hashes; sessions expire.
- Accountability: tamper-evident hash-chained audit log of significant actions; no self-approval of reviews; AI cannot approve, sign or certify.
- AI: language model on Amazon Bedrock in Mumbai; document content treated as untrusted data, never instructions; answers cite their sources.
- Secrets: AWS Secrets Manager; no secrets in code.
- Logging: application logs 180 days; AWS CloudTrail, CDN and network flow logs in a Mumbai bucket for 400 days.
- Backups: automated database backups (7 days) and S3 versioning, in Mumbai.
- Incident response: documented procedure including CERT-In 6-hour reporting.
- Planned: independent VAPT; ISO 27001.
Annex B – Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, storage, AI model (Amazon Bedrock), email notifications (Amazon SES) | India – Mumbai region |
| Google (Google Workspace) | Evidaro's own email, only if Customer emails personal data to us | Global |