How We Keep Your Data Safe

At Finvastra, financial trust and data security are inseparable. When you share your name, mobile number, or financial details with us, you are trusting us with sensitive information. This page explains exactly how we protect it — and what you can do to stay safe when interacting with financial services online.

Encryption & Transmission Security

Our website operates exclusively over HTTPS. The HTTPS padlock visible in your browser confirms that:

• All data submitted through our forms is encrypted in transit using TLS 1.3 (or TLS 1.2 minimum for older browsers).
• Our SSL certificate is issued by a trusted Certificate Authority and renewed automatically before expiry.
• HTTP connections are automatically redirected to HTTPS — no unencrypted form submissions are possible.
• Strict Transport Security (HSTS) headers instruct your browser to always use HTTPS for our domain.

What Data We Store — and How

Our website is hosted on GitHub Pages (Microsoft infrastructure). Our advisory operations use cloud-based CRM tools. Data handling standards:

• Enquiry data (name, mobile, city, service) — stored in our CRM with role-based access controls. Retained for 3 years.
• CIBIL Check data (name, PAN, DOB) — transmitted directly to TransUnion CIBIL API over encrypted channels. Not stored in our primary database beyond what is required for audit compliance.
• Analytics data — collected anonymously via Google Analytics (GTM). No personally identifiable information is sent to analytics systems without explicit consent.
• No passwords — our Platform does not have user accounts or login functionality. No passwords are ever stored.
• No payment data — we do not process or store any credit card, UPI, or banking credential information.

Regulatory Compliance

Our information security practices are aligned with the following Indian regulatory frameworks:

• Information Technology Act 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 — our security practices meet the “reasonable security practices” standard prescribed under Section 43A.
• Digital Personal Data Protection Act 2023 (DPDP Act) — data minimisation, purpose limitation, consent management, and data principal rights are implemented in accordance with the Act.
• CERT-In Guidelines — our incident response procedures are aligned with CERT-In cybersecurity directives, including reporting timelines for significant incidents.
• IRDAI Cybersecurity Guidelines — applicable to our insurance advisory operations.
• RBI Outsourcing Guidelines — our DSA loan facilitation operations comply with RBI guidelines on outsourcing and data handling by Direct Sales Agents.

Protecting Yourself Online

Our Team Security Practices

All Finvastra employees and advisors who handle customer data are subject to:

• Confidentiality agreements covering customer personal and financial information;
• Role-based access to CRM and customer data — advisors can only access the cases assigned to them;
• Prohibition on downloading, exporting, or sharing customer data outside of authorised advisory workflows;
• Immediate data access revocation upon termination of employment or advisory relationship;
• Annual security awareness training covering phishing, social engineering, and data handling best practices.

Third-Party Security

We carefully evaluate the security practices of third-party services integrated into our Platform:

• GitHub Pages — enterprise-grade infrastructure with SOC 2 Type II compliance.
• Google Analytics / GTM — data is anonymised; no personal identifiers are sent to Google Analytics without consent.
• TransUnion CIBIL API — industry-standard API with mutual TLS authentication; data transmitted only for CIBIL score retrieval with explicit user consent.
• WhatsApp Business API — end-to-end encrypted messaging; no sensitive financial data is shared over WhatsApp.

Data Breach Response

In the event of a data breach or security incident that may affect your personal data, we will:

1. Identify and contain the breach within 6 hours of detection;
2. Assess the nature and scope of the breach within 24 hours;
3. Notify affected users as required by the DPDP Act 2023;
4. Report significant incidents to CERT-In within the prescribed timeline;
5. Take remediation steps and publish a summary of the incident and response on this page.

Vulnerability Disclosure

We welcome responsible security disclosures. If you discover a vulnerability in our Platform or services, please report it to us privately before disclosing it publicly. This allows us to investigate and remediate the issue to protect our users.

Contact for Security Concerns

For any security-related questions, concerns, or to report suspicious activity:

• Email: security@finvastra.com
• Phone: +91 92475 19004 (Mon–Sat, 9 AM–6 PM IST)
• Address: Unit 305, 3rd Floor, Imperial Towers, 7-1-617/A, Ameerpet, Hyderabad, Telangana 500038

Also see our Privacy Policy and Terms of Service for related information on data handling and user rights.