Encryption
Data is encrypted in transit and at rest. Secrets live in a managed KMS or vault; no credentials are held in source code.
- TLS for all transport
- Encryption at rest across stores
- KMS/Vault-managed secrets
- Key rotation policy
Security & Privacy
Secure. Compliant. Enterprise-ready.
Civiq.plus holds data about how communities are treated, which makes it sensitive in ways ordinary business data is not. The controls below are the ones that matter most for that, and several of them are deliberately architectural rather than configurable.
AI Datacenter
Dedicated GPUs
Data Privacy
By Design
Role-Based
Access Control
End-to-End
Encryption
99.9%
Uptime SLA
India
Data Residency
Controls
How the platform is protected
Tenant isolation
Authorization and data partitioning are tenant-scoped. A support workflow is required and audited before any platform operator can reach tenant data.
- Tenant boundary on every query
- Partitioned storage
- No default operator access
- Controlled, audited support path
Role and geography scope
Permissions are both role-based and geography-scoped. An action is allowed only when the tenant matches, the role permits it, and the resource sits inside the user's geographic scope.
- Thirteen default roles
- Geographic scope on every check
- Domain policy gate
- Consent state must be satisfied
Authentication
MFA and SSO for control-room users, with device binding and secure key storage for mobile field staff where the deployment requires it.
- SAML and OIDC single sign-on
- MFA enforcement
- Device binding for field staff
- Session and presence controls
Immutable audit
Approvals, broadcasts, status changes and AI agent runs are written to an append-only history, traceable to a person and a time.
- Append-only event history
- Preserved across reopens
- Correlated with traces
- Exportable for review
Dedicated AI infrastructure
Model inference runs on dedicated GPU capacity in our own AI datacenter, not on shared public inference endpoints.
- Tenant data stays inside infrastructure we control
- Predictable throughput under load
- Model versions pinned per deployment
- No third-party training on your data
Residency and recovery
Regional data residency is configurable. Disaster recovery procedures are tested rather than documented and assumed.
- Configurable regional residency
- Private cloud and on-premise options
- Tested restore procedures
- Graceful degradation on source failure
Data classification
Four classes, four default control sets
Classification drives access scope, audit requirement and retention. It is applied at the record level, not left to a folder convention.
| Class | Examples | Default controls |
|---|---|---|
| Public | Published assets, public event details | Low sensitivity; integrity still controlled |
| Internal | Tasks, operational chat, programme plans | Authenticated tenant users only |
| Confidential | Feedback containing personal data, contact records, live location | Need-to-know geographic and role scope, audited |
| Restricted | Security-sensitive routes and special operations | Explicit allow-list, short retention where feasible |
Privacy posture
Guardrails the platform will not remove
These are stated as non-goals in the product specification, which means they constrain what can be built rather than what is switched on.
Aggregate over individual
The platform is built for aggregate geographic, cohort and community intelligence. It does not create covert individual-level political psychographic scores or hidden persuasion profiles, and that constraint is architectural rather than a setting.
Consent and opt-out registry
Direct communication is checked against a consent and opt-out registry. A connector cannot widen the permission that was granted when the record was created.
PII minimisation
Personal data is minimised, and identity is held in a separate vault where the deployment allows it, so analytical stores do not need to carry identifiers.
No inauthentic engagement
The platform does not fabricate public support, impersonate citizens or automate inauthentic engagement. Outbound communication follows applicable consent, privacy, telecom and messaging-platform rules.
Location is sensitive
Field worker and member location data is treated as confidential and access is restricted by role and geography rather than granted broadly for convenience.
Retention by data class
Retention and deletion policies are defined per data class rather than applied uniformly, so restricted data is not held longer than it needs to be.
Questions
What security teams ask first
Where is our data stored?
Regional data residency is configurable per deployment. On the National tier, private-cloud and on-premise deployment are available so that data never leaves infrastructure you control.
Can Civiq.plus staff see our data?
There is no default access to tenant data. Reaching tenant data requires a controlled support workflow that is itself recorded in the audit log.
How is AI-generated content controlled?
Agents are registered with explicit data scopes, geographic scopes, cost and latency ceilings and an approval policy. High-impact material does not publish without a human approval, and every run records the model, provider, version, inputs, outputs and the human decision.
What happens to a citizen's personal data in a feedback record?
The record carries its consent context. Personal data is classified as confidential, scoped to need-to-know access by role and geography, and covered by a retention policy for that class. Exports are permission-scoped and there is no uncontrolled export of personal data.
Do you support penetration testing?
Yes. Customer-initiated penetration testing is supported under a scoping agreement. Contact us to arrange the window and rules of engagement.
Where does the AI workload run?
Model inference runs on dedicated GPU capacity in our own AI datacenter rather than on shared public inference endpoints. That keeps tenant data inside infrastructure we control, makes throughput predictable under load, and means a model version does not change underneath a deployment without us deciding it should.
What compliance documentation is available?
Architecture documentation, our control mapping, data-flow diagrams and the current status of any independent assessment are available under NDA. Contact us for the security package and we will send what applies to your procurement process.
Reporting a vulnerability
If you believe you have found a security issue in Civiq.plus, email [email protected] with enough detail to reproduce it. We acknowledge reports within two business days and will keep you updated until the issue is resolved. Please do not disclose publicly until we have had a reasonable window to fix it.
Need the full security package?
Architecture documentation, control mapping and current certification status are available under NDA.