FOHRKAST: SECURITY SUMMARY AND QUESTIONNAIRE ANSWERS Version 2026-10-31 Operator: Zazer Ventures LLP (LLPIN ABZ-5865), India. Registered office: fohrkast.com/company-information#contact. Security questions: tech@fohrkast.com. Other questions: support@fohrkast.com, +91 77009 97777. Each statement below is taken from fohrkast.com/trust, fohrkast.com/dpa, fohrkast.com/sub-processors or the infrastructure code as deployed. Not legal advice. 1. SECURITY SUMMARY Security standards Fohrkast holds no certification against a security standard yet. Fohrkast's written information security policy, version of 28 Oct 2026, is at fohrkast.com/security-policy. Penetration test: Not yet performed by an outside firm. Encryption at rest The database (Amazon RDS for PostgreSQL) and its backups are encrypted with AES-256 under Fohrkast's data key in AWS KMS. The server disk is encrypted (AES-256). Personal details are also sealed with a key per person (AES-256-GCM), each wrapped by AWS KMS; destroying that key makes them unreadable. Encryption in transit Every page and API answers over HTTPS only (TLS 1.2 and 1.3), and fohrkast.com is served through Amazon CloudFront. Current browsers agree keys there over X25519 with ML-KEM (post-quantum) or over X25519; CloudFront uses P-256 or P-384 only for older software that offers neither. The server behind it accepts X25519 or P-384, with P-256 kept as a last resort for CloudFront's own connection. HTTP Strict Transport Security is set for two years including subdomains. The application reaches the database over TLS with the certificate verified, signing in with 15-minute AWS IAM tokens instead of a stored password. Keys Keys are held in AWS KMS in Mumbai, with a replica of the data key in Hyderabad for the backup copy. Signing keys are ECDSA P-384 with SHA-384: rulebook releases, scanner releases and scanner activation. The first two rulebook releases carry earlier P-256 signatures. Secrets and tokens Fohrkast issues (API keys, links, receipts, webhook secrets) are 48 random bytes (384 bits). Access Access is by seat. Seats that open sealed details or approve steps sign in with an authenticator app. Each opening of sealed details is logged. Fohrkast staff do not open a business's records in the normal course. Emergency access needs a recorded reason and a time limit, is human only, and shows in the business's own log. The application server takes web traffic only, on ports 80 and 443, with a limit of 20 requests a second from one address (bursts of up to 40). It has no SSH: people reach it through AWS Session Manager, and every session is logged to CloudWatch for one year. The database has no public address; only the application server reaches it. Backups - Database backups are taken daily and kept 7 days in Mumbai. - An encrypted copy of the backups is kept 35 days in Hyderabad, under a replica of the data key. - Erased data is gone from backups within 35 days. - Restore tested on production on 26 Oct 2026: the encrypted backup copy in Hyderabad was restored into a separate private database in 25 minutes; the newest restorable point was 12 minutes old. Logs - Logs are kept one year in AWS Mumbai: web server logs, which hold visitor IP addresses; application, system and session logs; and database logs, without statements or values. - Records of account activity are write locked for one year, with a copy in Hyderabad. - Server clocks follow the time servers of NIC and NPL (CERT-In Directions, 28 April 2022). - Each night, one fingerprint covering every business's audit trail is sent for timestamping (RFC 3161) to independent timestamping services in Germany, the United States, the United Kingdom and Poland. A night counts as stamped once at least two of them have signed it, each signature checked against that service's own root certificate. The services receive the fingerprint only, never records or personal data. Each night's seal, with its fingerprint and signed tokens: fohrkast.com/trust/seal. AI - Fohrkast uses no AI model to process the records it holds for a business. - Fohrkast never sends records it holds for a business (sealed details, consent records, request threads, uploaded files) to any AI model, and never uses them to train one. - AI coding and rule drafting tools used to build Fohrkast never hold production credentials or customer data. Emergency access stays human only. - Any later AI feature is added under the processor agreement's sub processor notice, can be switched off per workspace, and states plainly that names cannot be reliably detected. The scanner (runs in the business's own environment) - fohrkast-scan runs on a server in the business's own network and reads each database or file store through a read only login that the business's administrator creates from a script the scanner prints. - It transmits metadata only: table and column names, data types, the kinds of personal data found, counts and, where the database keeps query statistics, the logins and applications that read each table. Personal data values and database credentials remain on that server. Each report is checked against a fixed list of permitted fields before it is sent, and again when Fohrkast receives it. - Before every run it confirms its scanner key with Fohrkast over HTTPS: the key must be live and not retired, the workspace active, the version not below Fohrkast's minimum and the file one Fohrkast released. Otherwise it reads nothing and sends nothing. A retired key stops the next run. - Each release is signed with an ECDSA P-384 key (SHA-384) held in AWS KMS and used only from a person's administrator sign in; machines never sign. Every file of a release has a published SHA-384 checksum, and the release public key is in each installation package. - Only signed in seats download it: a business's owner, privacy lead or developer, and the seats of a partner firm or distributor. Each download link is valid for 5 minutes, and each download is recorded in the workspace's log. Incident response - Fohrkast reports cyber incidents on its own systems to CERT-In within 6 hours of noticing them (CERT-In Directions, 28 April 2022). - Fohrkast tells each affected business without delay and within 24 hours of detection, and drafts that business's intimations to the Data Protection Board and to affected persons (s.8(6), Rule 7). The business decides and sends them. Continuity Fohrkast is built and operated by one person, its founder, Abhinv Das. When he is away, the service keeps running: dates, reminders, consent pages and request pages need no operator. Rulebook updates, advisories and support replies wait for his return. Nothing publishes itself. Opening a business's records goes through emergency access, which the business sees in its own log. Security reports Security reports go to tech@fohrkast.com. A report states the address or feature affected, the steps that reproduce the issue, and a contact for follow up. Reports are acknowledged within 3 working days. Testing must not read, change or delete another business's data, slow or interrupt the service, or use social engineering. Fohrkast runs no paid bug bounty. The full policy, with what is in scope and the rules for testing: fohrkast.com/security. 2. SUB-PROCESSORS - Amazon Web Services: Amazon EC2, Amazon RDS for PostgreSQL, AWS KMS; Application server, database, encryption keys; Mumbai, India (ap-south-1) - Amazon Web Services: Amazon SES; Product email: sign in codes, reminders, alerts; Mumbai, India (ap-south-1) - Amazon Web Services: Amazon CloudWatch Logs, AWS CloudTrail, Amazon S3; Server, application and audit logs; Mumbai, India (ap-south-1); audit copies in Hyderabad, India (ap-south-2) - Amazon Web Services: Amazon RDS backup copy, AWS KMS replica key; Encrypted copy of the database backups, kept 35 days; Hyderabad, India (ap-south-2) - Razorpay Software Private Limited: Razorpay Payment Links; Payment of Fohrkast's own invoices: billing only, never a record a business holds in Fohrkast.; India 3. QUESTIONNAIRE ANSWERS Company and governance - Legal entity: Zazer Ventures LLP, a limited liability partnership registered in India (LLPIN ABZ-5865). Registered office: fohrkast.com/company-information#contact. - Who is responsible for information security: Fohrkast is built and operated by one person, its founder, Abhinv Das, who is responsible for information security. - Written information security policy: Fohrkast information security policy, version of 28 Oct 2026, at fohrkast.com/security-policy. - Certifications (ISO/IEC 27001, SOC 2 or similar): Fohrkast holds no certification against a security standard yet. - Penetration test: Not yet performed by an outside firm. Data location and sub-processors - Where data is stored and processed: Amazon Web Services, Mumbai (ap-south-1). An encrypted copy of the backups and copies of the audit logs in Hyderabad (ap-south-2). Every listed sub-processor runs in India. Records a business holds in Fohrkast, and Fohrkast's servers, backups and logs, are in India: in Mumbai, with backup and audit copies in Hyderabad. - Sub-processors: The list at fohrkast.com/sub-processors, as section 2 of this file. - Notice of a new sub-processor: Fohrkast gives the business notice before a new sub-processor receives personal data, and holds each sub-processor to obligations no less protective than the processor agreement's. - Right to object to a new sub-processor: The business may object to a new sub-processor by writing to support@fohrkast.com before it receives personal data. If the objection cannot be met, the business may close its account before that date, after exporting its records. Data protection - Role under the DPDP Act: The business is the Data Fiduciary (s.2(i)). Fohrkast is its Data Processor (s.2(k)) under the processor agreement, which is the contract s.8(2) requires. - Personal data held: The least a duty needs. Personal details are sealed per person; audit records carry references, never the details. - Use of business data for AI or for training: Fohrkast uses no AI model to process the records it holds for a business, never sends them to an AI model and never uses them to train one. - Return and erasure at the end of the contract: The business can export its records at any time as an evidence pack. On closing the account, after the chance to export, Fohrkast erases the personal data it holds for the business (s.8(7)); erased data is gone from backups within 35 days. Encryption and keys - Encryption at rest: The database (Amazon RDS for PostgreSQL) and its backups are encrypted with AES-256 under Fohrkast's data key in AWS KMS. The server disk is encrypted (AES-256). Personal details are also sealed with a key per person (AES-256-GCM), each wrapped by AWS KMS; destroying that key makes them unreadable. - Encryption in transit: Every page and API answers over HTTPS only (TLS 1.2 and 1.3), and fohrkast.com is served through Amazon CloudFront. Current browsers agree keys there over X25519 with ML-KEM (post-quantum) or over X25519; CloudFront uses P-256 or P-384 only for older software that offers neither. The server behind it accepts X25519 or P-384, with P-256 kept as a last resort for CloudFront's own connection. HTTP Strict Transport Security is set for two years including subdomains. The application reaches the database over TLS with the certificate verified, signing in with 15-minute AWS IAM tokens instead of a stored password. - Key management: Keys are held in AWS KMS in Mumbai, with a replica of the data key in Hyderabad for the backup copy. Signing keys are ECDSA P-384 with SHA-384: rulebook releases, scanner releases and scanner activation. The first two rulebook releases carry earlier P-256 signatures. Secrets and tokens Fohrkast issues (API keys, links, receipts, webhook secrets) are 48 random bytes (384 bits). Access control - Access for a business's people: Access is by seat, each a fixed set of permissions. Seats that open sealed details, approve steps or make API keys sign in with an authenticator app; 5 wrong codes in a row lock the account for 15 minutes. Each opening of sealed details is logged. - Access by Fohrkast staff: Fohrkast staff do not open a business's records in the normal course. Emergency access needs a recorded reason and a time limit, is human only, and shows in the business's own log. - Administrative access to servers: The application server takes web traffic only, on ports 80 and 443, with a limit of 20 requests a second from one address (bursts of up to 40). It has no SSH: people reach it through AWS Session Manager, and every session is logged to CloudWatch for one year. The database has no public address; only the application server reaches it. Logging and monitoring - Logs and retention: Every log one year: web server logs (visitor IP addresses), application, system and session logs, and database logs, without statements or values. All in AWS Mumbai. - Integrity of records: Records of account activity are write-locked for one year, with a copy in Hyderabad. Every event in a workspace sits on a hash-chained audit trail (SHA-256) in the published format at fohrkast.com/law/hash-v1. - Time source: Server clocks follow the time servers of NIC and NPL (CERT-In Directions, 28 April 2022). Vulnerability management - Penetration test: Not yet performed by an outside firm. - Reporting a vulnerability: Security reports go to tech@fohrkast.com; the policy is at fohrkast.com/security and fohrkast.com/.well-known/security.txt. - Patching: The server runs Ubuntu with its unattended security upgrades; the database takes PostgreSQL minor version upgrades automatically. - Releases: Each release is built from a commit, checked against its SHA-256 on the server before it is unpacked, and switched back to the previous release if the health check after the switch fails. Every page carries a Content-Security-Policy that allows this site's own scripts, styles, fonts and images only. Incident management - Reporting to CERT-In: Fohrkast reports cyber incidents on its own systems to CERT-In within 6 hours of noticing them (CERT-In Directions, 28 April 2022). - Telling the business: Fohrkast tells the business of a personal data breach affecting its data without delay and within 24 hours of detection. - Breach intimations under the DPDP Act: Fohrkast drafts the intimations to the Data Protection Board and to each affected person (s.8(6), Rule 7). The business decides and sends them. Business continuity - Infrastructure: One Amazon RDS for PostgreSQL instance in one availability zone in Mumbai, with daily backups. - Backups: Database backups are taken daily and kept 7 days in Mumbai. An encrypted copy of the backups is kept 35 days in Hyderabad, under a replica of the data key. - Tested restore: Restore tested on production on 26 Oct 2026: the encrypted backup copy in Hyderabad was restored into a separate private database in 25 minutes; the newest restorable point was 12 minutes old. - Key person: Fohrkast is operated by one person. When he is away, the service keeps running; rulebook updates, advisories and support replies wait for his return. Regulated buyers - Contract terms for RBI's outsourcing directions: Not offered yet. - Right to audit for the buyer and its regulator: The processor agreement gives each business the information it needs to show the agreement is met: the evidence pack, the audit trail and the agreement's version history (fohrkast.com/dpa#evidence). An on-site audit or a regulator's inspection right is not offered yet. - Separate environment for one buyer: Not available yet; from late 2027 on the Institution plan. Fohrkast is operated by Zazer Ventures LLP.