Boring, documented, and in writing.
Data processing terms
Every client signs a Data Processing Addendum covering what we handle, where it is stored, how long we retain it, and what happens when the relationship ends.
DPDP Act 2023
You are the Data Fiduciary for your customers' personal data. Ophriel Systems acts as your Data Processor and operates under your written instruction.
Server location, disclosed before you sign
Your Data Processing Addendum states the exact region your data is hosted in, including whether any processing takes place outside India. We put it in the contract, not in a footnote.
Tenant isolation
Every client's data is scoped by organisation at the database level. Cross-client access is structurally prevented, not policy-prevented.
Encryption
Sensitive fields, identity documents in particular, are encrypted at the application layer — not only at rest on the disk.
Backups
Automated, stored separately from the primary hosting provider, and test-restored. A backup nobody has ever restored is a rumour, not a backup.
Payments
Card and payment data is handled entirely by Razorpay. Ophriel Travel CRM does not store card details.
Want the details in writing?
Ask for the Data Processing Addendum when we scope your deployment — it names the region, the retention terms, and what happens if you leave.