Skip to main content
Compliance & Trust

Security and Compliance

This page describes the safeguards present in the application code and the items that still depend on deployment configuration. It is not a certification or a claim of complete legal compliance.

Transport and storage security

Production HTTPS is provided by the hosting and service providers. Encryption at rest, key management, backup access, and retention depend on each provider’s configuration and have not been independently audited in this repository. The application uses authenticated API routes and HTTP security headers; these controls do not guarantee confidentiality.

Do not submit highly sensitive case information until you have reviewed the applicable service and provider terms.

Hosting locations

The repository does not establish that all production data is hosted in India. Hosting regions and cross-border processing depend on the current frontend, backend, database, AI, analytics, storage, and communications provider configurations. Confirm those regions and subprocessors before using the service for restricted data.

Subprocessors & LLM safety

We integrate secure API infrastructure for processing localized text:

Gemini API (Google Cloud Platform)Used by the backend to generate responses. Review Google’s terms for the configured account and region to understand processing, retention, and data use. Avoid sending sensitive information unless the applicable terms have been reviewed.
Twilio APIUsed in selected messaging and verification flows. Processing and retention are governed by the configured account and Twilio terms.

Your data rights (DPDP Act)

For access, correction, or deletion requests, contact NyayNow through the contact page. Requests are handled subject to identity verification, applicable law, and the data systems currently in use. Review the privacy policy for the published process.

Contact Redressal Officer →
Security and Privacy | NyayNow