Security
How we handle your data.
You are about to let an outsider into your enquiries, your inbox and sometimes your customer list. This page is what we commit to before that happens. If your procurement team has a form, send it over, this answers most of it.
The commitments
You own the data. We act on your instructions.
Under the DPDP Act you are the data fiduciary for your own customers. Persuadra is a processor. We use your data to do the job you asked for and for nothing else, ever, including anything of our own.
We build it, you own it.
Systems are built inside your accounts, on your keys, under your billing wherever the platform allows it. When the engagement ends you keep the whole thing running. There is no switch on our side to turn off.
Least access, and it expires.
We ask for the narrowest access that lets the work happen, named to one person rather than a shared login, and we tell you which accounts to revoke on the last day. If read-only will do, we ask for read-only.
Encrypted in transit and at rest.
Everything we build on encrypts data in transit and at rest as standard. We will name the platforms holding your data, and where they hold it, before you hand anything over.
No model training on your data.
Your data is never used to train a model, ours or anyone else's. Where an AI provider offers zero data retention on their API, that is how we configure it, and we will tell you which providers are in the build.
A one-page DPA before the work starts.
Short, readable, signed before any data moves. It names the actual processors for your build, what they may do, and what happens at the end. An NDA on your paper is fine too, just send it.
Deleted when we are done.
At the end of an engagement we return or delete what we hold, at your choice, and confirm in writing when it is gone. If a trial does not turn into work, the same thing happens and you do not have to ask.
Told within 72 hours.
If anything on our side is breached or exposed, you hear it from us within 72 hours, with what happened, what was affected and what we have done. We would rather tell you early and be wrong about the scale.
Consent is captured by you, upstream.
The systems we build reply to people who contacted you. Consent is collected at your ad or your form, before anything reaches us. We never gather it ourselves and we never message a list we were handed with no record of where it came from.
Outbound built to the rules of its market.
For Indian senders that means DLT registration, DND scrubbing, calls inside the 9am to 9pm window and a working opt-out. For US numbers it means the carrier rules for the channel. We build to those from the start rather than patching them in after a block.
Your customers see your name.
Every message a system we build sends goes out under your brand, from your numbers and your domain. Persuadra does not appear in front of your customers unless you want it to.
We stay small, and that cuts both ways.
There is no support floor and no offshore team with a copy of your database. There is also no committee to hide behind. One named person handles your data and answers for it.
Still have questions?
Happy to walk through any of this on a call, sign your NDA first, or send the DPA before you commit to anything.
Book a security walkthrough We use what we sell.Experience it firsthand.Get a response in less than 60 seconds.