Regulatory Infrastructure
Statutory compliance and sovereign data protection.
Veinz is engineered from the ground up for India's Digital Personal Data Protection Act, CERT-In cybersecurity directives, and international vascular biometric standards.
DPDP Act 2023
India's Digital Personal Data Protection framework
The Digital Personal Data Protection Act (DPDP Act), 2023 establishes statutory accountability for biometric data processing in India. Veinz Core is built around strict purpose limitation, transparency, and explicit user agency.
- Prior itemized notice: Every person receives an itemized notice in plain language stating the precise purpose (such as shift attendance, door access, or cafeteria payments) before any palm scan is performed.
- Strict purpose limitation: Biometric templates are cryptographically confined to their approved use case. Veinz never uses palm templates for behavioral profiling, marketing, or secondary analytics.
- Statutory right to erasure: Under Section 12 of the DPDP Act, users have the right to withdraw consent and request complete deletion. Automated purge commands propagate across all terminals and cloud ledgers within 48 hours.
- Non-biometric alternative: Biometric participation is voluntary. Organizations provide smartcards or mobile passes for any individual who declines biometric enrolment, without imposing adverse consequences.
Minor & Student Protection
Verifiable consent for students under eighteen
The DPDP Act enforces rigorous restrictions on the processing of minors' personal data. For educational campuses with students under 18 years of age, Veinz enforces mandatory safeguarding controls.
- Verifiable parental consent: Institutions onboard minors only after acquiring verifiable digital authorization from a parent or legal guardian prior to template activation.
- Zero behavioral tracking: Student activity is never tracked or profiled for commercial purposes. Campus attendance records serve purely academic and safety administration.
- Automated graduation purge: Upon course completion or school transfer, student templates are automatically scheduled for cryptographic purge with written confirmation issued to guardians.
Cybersecurity Governance
CERT-In cybersecurity mandates and operational readiness
In accordance with Indian Computer Emergency Response Team (CERT-In) directives, Veinz maintains strict operational protocols for time synchronization, logging, and incident response.
- 6-hour incident reporting window: Dedicated 24/7 security desks and automated intrusion detection mechanisms ensure mandatory reporting of verified cybersecurity incidents within statutory timelines.
- NTP clock synchronization: All Veinz hardware terminals, access controllers, and cloud ledgers synchronize directly against Indian National Physical Laboratory (NPL) standard NTP servers for reliable, auditable event timelines.
- Tamper-proof log retention: System access logs and administrative audit trails are stored in write-once-read-many (WORM) encrypted domestic archives for the legally required retention duration.
Data Sovereignty
100% Domestic Indian hosting and sovereign enclaves
Sovereign data residency is a core architectural requirement. All Veinz cloud infrastructure and cryptographic keys reside strictly within Indian national borders.
- MeitY-empanelled cloud data centers: Primary and disaster-recovery nodes operate in certified enterprise data centers in Mumbai and Hyderabad, India. Data never leaves Indian sovereign territory.
- Zero cross-border transfer: Biometric template vectors and organizational ledgers are never replicated, backed up, or routed through foreign cloud regions.
- FIPS 140-2 Level 3 HSM enclaves: Master decryption keys are isolated in certified Hardware Security Modules (HSM) with strict multi-party quorum controls.
Biometric Engineering
ISO/IEC 19794-9 & ISO/IEC 27001 operational standards
Veinz implements globally validated technical standards to guarantee recognition accuracy, cryptographic privacy, and information security.
- Irreversible 256-bit vectorization: Raw infrared hand captures exist in volatile RAM only during sensor exposure and are instantly destroyed. Only non-invertible mathematical feature vectors are stored.
- ISO/IEC 19794-9 compliance: Vascular biometric data interchange formats adhere to international industry standards for sensor precision and biometric interoperability.
- ISO/IEC 27001 & SOC 2 operational controls: Comprehensive administrative, operational, and network safeguards audited periodically by independent security assessors.
For Legal, Compliance & Procurement Teams
Need enterprise compliance documentation?
Request our complete SOC 2 compliance pack, standard Data Processing Addendum (DPA), and DPDP statutory alignment matrix.
Data Protection Officer & Governance Desk: Veinz Data Governance Desk, Bengaluru, Karnataka, India · privacy@veinz.co