Trust

Fohrkast holds no certification against a security standard yet.

Fohrkast's written information security policy, version of 28 Oct 2026, is at fohrkast.com/security-policy.

A plain text file of the facts on this page, the processor agreement and the sub processor list, with answers under the usual headings of a vendor security questionnaire: fohrkast.com/trust/security-summary.txt.

Records a business holds in Fohrkast, and Fohrkast's servers, backups and logs, are in India: in Mumbai, with backup and audit copies in Hyderabad.

• » Database backups are taken daily and kept 7 days in Mumbai.
• » An encrypted copy of the backups is kept 35 days in Hyderabad, under a replica of the data key.
• » Erased data is gone from backups within 35 days.
• » Restore tested on production on 26 Oct 2026: the encrypted backup copy in Hyderabad was restored into a separate private database in 25 minutes; the newest restorable point was 12 minutes old.

• » Logs are kept one year in AWS Mumbai: web server logs, which hold visitor IP addresses; application, system and session logs; and database logs, without statements or values.
• » Records of account activity are write locked for one year, with a copy in Hyderabad.
• » Server clocks follow the time servers of NIC and NPL (CERT-In Directions, 28 April 2022).
• » Each night, one fingerprint covering every business's audit trail is sent for timestamping (RFC 3161) to independent timestamping services in Germany, the United States, the United Kingdom and Poland. A night counts as stamped once at least two of them have signed it, each signature checked against that service's own root certificate. The services receive the fingerprint only, never records or personal data. Each night's seal, with its fingerprint and signed tokens: fohrkast.com/trust/seal.

• » Fohrkast uses no AI model to process the records it holds for a business.
• » Fohrkast never sends records it holds for a business (sealed details, consent records, request threads, uploaded files) to any AI model, and never uses them to train one.
• » AI coding and rule drafting tools used to build Fohrkast never hold production credentials or customer data. Emergency access stays human only.
• » Any later AI feature is added under the processor agreement's sub processor notice, can be switched off per workspace, and states plainly that names cannot be reliably detected.

• » fohrkast-scan runs on a server in the business's own network and reads each database or file store through a read only login that the business's administrator creates from a script the scanner prints.
• » It transmits metadata only: table and column names, data types, the kinds of personal data found, counts and, where the database keeps query statistics, the logins and applications that read each table. Personal data values and database credentials remain on that server. Each report is checked against a fixed list of permitted fields before it is sent, and again when Fohrkast receives it.
• » Before every run it confirms its scanner key with Fohrkast over HTTPS: the key must be live and not retired, the workspace active, the version not below Fohrkast's minimum and the file one Fohrkast released. Otherwise it reads nothing and sends nothing. A retired key stops the next run.
• » Each release is signed with an ECDSA P-384 key (SHA-384) held in AWS KMS and used only from a person's administrator sign in; machines never sign. Every file of a release has a published SHA-384 checksum, and the release public key is in each installation package.
• » Only signed in seats download it: a business's owner, privacy lead or developer, and the seats of a partner firm or distributor. Each download link is valid for 5 minutes, and each download is recorded in the workspace's log.

Each signed rulebook version and each correction has a dated public note at fohrkast.com/law/changes.

Fohrkast is built and operated by one person, its founder, Abhinv Das.

When he is away, the service keeps running: dates, reminders, consent pages and request pages need no operator. Rulebook updates, advisories and support replies wait for his return. Nothing publishes itself.

Opening a business's records goes through emergency access, which the business sees in its own log.

• » Fohrkast reports cyber incidents on its own systems to CERT-In within 6 hours of noticing them (CERT-In Directions, 28 April 2022).
• » Fohrkast tells each affected business without delay and within 24 hours of detection, and drafts that business's intimations to the Data Protection Board and to affected persons (s.8(6), Rule 7). The business decides and sends them.

Security reports go to tech@fohrkast.com. A report states the address or feature affected, the steps that reproduce the issue, and a contact for follow up.

Reports are acknowledged within 3 working days.

Testing must not read, change or delete another business's data, slow or interrupt the service, or use social engineering.

Fohrkast runs no paid bug bounty.

The full policy, with what is in scope and the rules for testing: fohrkast.com/security.