Grow and run
How we protect your data
What Gandiv does today to keep your leads and recordings private, and what we have not yet done, stated plainly.
Row-level security
Tenant isolation enforced inside the database
2FA and roles
OTP or authenticator login with granular permissions
Audit log
Who did what, before and after, with IP and device
What is security and compliance?
Your CRM holds customer phone numbers, call recordings and deal values, so protection has to be built in rather than added later. Gandiv isolates every workspace in the database, encrypts data in transit and at rest, controls access by role and records activity in an audit log. We are aligned with the principles of India's DPDP Act. Certifications: none held yet. We will list them here only when they are issued.
Benefits
Tenant isolation
Every record belongs to one workspace and the database itself blocks reads across workspaces, tested as the application role.
Encryption
Data is encrypted in transit and at rest, and integration secrets are kept in a vault.
Roles and fields
Permission templates control modules, leads, fields, export and search per role.
2FA and sessions
Enforce OTP or authenticator codes, review devices, force logout and set session timeouts.
Audit trail
Changes are logged with before and after values, user, IP and device, and can be exported.
AI keys protected
Language model keys stay on the server and are never sent to the browser.
In detail
Encryption
Protected in transit and at rest
Connections use TLS, and stored data and recordings are encrypted at rest. Secrets such as integration keys sit in a vault and are not shown again after saving. Exports can be masked so phone numbers are not leaked to casual users.
- TLS in transit
- Encrypted at rest
- Masked exports
TLS in transit
Encrypted at rest
Masked exports
Roles and audit
Least access, full trail
Give each person only the modules, leads and fields they need. Optionally add IP allow-lists and login hours. The audit log records changes with before and after values, so you can answer who changed what and when.
- Permission templates
- IP and hour limits
- Before and after values
Permission templates
IP and hour limits
Before and after values
Data and DPDP
Built around Indian data rules
Gandiv records consent with purpose and source, supports withdrawal and erasure requests, and lets you set retention for recordings and transcripts. Data is intended to be hosted in India. This supports your compliance; it does not replace your own legal advice.
- Consent log
- Erasure requests
- Retention settings
Consent log
Erasure requests
Retention settings
Honest status
Certifications, sub-processors, reporting
We hold no security certifications yet and will not imply otherwise. A list of sub-processors is published on the site. If you find a vulnerability, report it through the security contact and we will respond and fix it responsibly.
- Certifications: none held yet
- Sub-processor list
- Report a vulnerability
Certifications: none held yet
Sub-processor list
Report a vulnerability
How it works
- 1
Set roles and 2FA
Create permission templates and require a second factor for your team.
- 2
Configure consent and retention
Choose recording consent, retention days and masking for exports.
- 3
Review the audit log
Check changes and logins regularly and export when needed.
Works with
Used in these industries
Frequently asked questions
Do you hold ISO 27001 or SOC 2?
No. We hold no certifications yet. What we describe here is how the product is designed and built, and we will list any certification only after it is awarded.
Can one customer see another customer's data?
The database enforces workspace isolation using row-level security, and we test this across workspaces before releases.
Where is my data stored?
We aim to host in India. Ask us for the current hosting location and sub-processor list before you sign.
Are you DPDP compliant?
The product is designed around the DPDP Act's principles with consent, erasure and retention tools. Compliance is a shared responsibility with you as the data fiduciary.
How do I report a security issue?
Write to the security contact on the site with details. We acknowledge reports and fix confirmed issues.
See Gandiv on your own leads
Start free, or book a short demo and we will set it up with your pipeline.