Sakshi is single-tenant and runs inside your environment. Personal identifiers are tokenized before anything is stored, every decision lands on a chain anyone can recompute, and we never see your evidence. This page is the detail your security team will want to read.
Isolation & data model
The strongest control we offer is architectural: Sakshi installs in your environment and stays there, so the question of what a vendor could do with your data mostly does not arise.
Each customer runs their own instance in their own VPC or on-prem. No shared control plane, no multi-tenant database, nothing to isolate between customers because there is nothing shared.
The platform does not phone Rotavision. It runs entirely within your network boundary, which means it works air-gapped and gives you nothing to allow-list outbound.
Because it runs where you put it, data residency is yours to set. India by default; wherever your policy requires otherwise.
Data handling
Sakshi is an evidence system, not a system of record for your sensitive data. It governs the act and holds the proof; it never becomes the place your raw identifiers live.
Personal identifiers are replaced with reference tokens before a record is written. Raw Aadhaar, PAN, card, and account numbers never enter the decision chain, so the evidence is defensible and the sensitive value is not sitting inside it.
The signing seed and tokenization configuration live in your instance, under your control. We cannot detokenize your records or forge a signature, because we do not hold the material to do so.
Traffic is TLS-encrypted. At rest, evidence sits on your infrastructure and inherits your storage encryption and key management, because it is your infrastructure.
Where a raw identifier must be stored, Sakshi verifies it landed in a compliant vault (for example a UIDAI-style Aadhaar Data Vault) by its reference key, without ever seeing the value.
Integrity
Every decision is hashed into a chain where each record seals the one before it. Recomputing the chain re-derives every hash, so tampering with a single field is not just detectable, the chain says exactly where it happened. Evidence packs are Ed25519-signed over their exact bytes.
Your security and compliance teams do not have to take Rotavision's word for the integrity of a record, and neither does your regulator.
Access, identity & operations
SAML and OIDC single sign-on against your IdP (Keycloak, Okta, Entra, Google Workspace). Role-based access with a read-only auditor role, mapped from your directory.
Who can approve a high-autonomy action, mint an ingest key, or administer the platform are distinct roles. Entitlement changes are themselves attested on the chain.
Privileged actions, kill-switch activations, and drills are recorded as evidence. Signed packs and full chain exports are available on demand.
Nightly evidence backups, a drilled kill switch with signed attestations, and one-command install and upgrade via Helm or docker-compose, on your schedule.
Compliance & provenance
Sakshi is built to produce regulator-grade evidence, DPDP-aligned by design (tokenization, minimization and localization screens, an auditor bundle). Formal certifications such as SOC 2 and ISO 27001 are on our roadmap; we will say so plainly here when they land, and not imply them before. Our governance models and SDKs are open and Apache-2.0 licensed, so the components you run are inspectable.
Responsible disclosure
We would rather you check than take our word for it. If you believe you have found a security issue, email [email protected] with details and steps to reproduce. We acknowledge reports, work them in good faith, and credit researchers who want it. Please test only against your own sandbox or deployment.
Download the overview (or request the full pack under NDA), then spin up a synthetic-data sandbox and verify the chain yourself.
