DATA SECURITY & COMPLIANCE
Effective Date: January, 2026
Last Updated: January, 2026
EXECUTIVE SUMMARY
At Realtors Robot by RSoft Technologies, data security is our highest priority. We understand that your business data represents the lifeblood of your operations, and every lead, customer interaction, and business decision is critical. We have implemented enterprise-grade security measures to protect your data in one of Asia's safest data centres
Our commitment includes zero tolerance for security violations, continuous monitoring on a 24/7/365 basis, regular audits and penetration testing, transparent reporting of security practices, and compliance with international standards such as GDPR and CCPA.
This document explains how we protect your data and why RSoft Technologies can be trusted with your most valuable business information.
OUR SECURITY PHILOSOPHY
Defense in Depth
RSoft Technologies follows a defense-in-depth strategy and does not rely on a single security control. Multiple layers of security are implemented to ensure comprehensive protection. Perimeter security includes firewalls and distributed denial-of-service protection. Network security incorporates encryption, virtual private networks, and network segmentation. Application security is enforced through secure coding practices, vulnerability testing, and code scanning. Database security includes encryption at rest and strict access controls. Physical security is maintained through secured data centers with controlled and biometric access. Administrative security is ensured through continuous monitoring, logging, and regular audits.
Security-First Culture
Every engineer at RSoft Technologies completes mandatory annual security training and adheres to secure coding practices. Engineers actively participate in security reviews and are encouraged to report potential security concerns without fear of retaliation. All employees are required to sign confidentiality agreements as part of their employment obligations.
Incident Response
RSoft Technologies maintains a 24-hour security operations center that provides real-time threat monitoring and alerting. A dedicated incident response team remains on standby at all times. Documented procedures are maintained for all security scenarios, and regular drills and simulation exercises are conducted to ensure preparedness.
DATA ENCRYPTION
Encryption in Transit
Encryption in transit protects data while it travels between your device and our servers. All communications are secured using TLS version 1.2 or higher. Perfect Forward Secrecy is enforced to ensure historical data remains secure even if an encryption key is compromised. Certificate pinning is implemented to prevent man-in-the-middle attacks, and HTTPS is enforced across the entire platform, not just on login pages.
As a result, your data remains protected even when accessed over unsecured networks. WhatsApp integrations are fully encrypted, call recording data is encrypted during transmission, and all communications remain secure and private.
Encryption at Rest
Encryption at rest protects data stored within our databases and servers. All customer data is encrypted using AES-256 encryption. Separate encryption keys are maintained for each customer, and encryption keys are rotated automatically on a periodic basis. Secure key management practices are followed to ensure encryption keys are stored and handled securely.
This approach ensures that even if physical infrastructure is compromised, the stored data remains unreadable without the appropriate encryption keys. Encrypted backups receive the same level of protection, and deleted data remains protected during the defined retention period.
Optional Enhanced Encryption
Customers with additional security requirements may request customer-controlled encryption keys, zero-access encryption layers, or customized enterprise security consultations to further enhance data protection.
ACCESS CONTROLS
Authentication
Multi-factor authentication is available for all customer accounts and is mandatory for administrative users. Supported authentication methods include time-based one-time passwords, SMS verification, and backup codes. These measures significantly reduce the risk of unauthorized access.
Passwords must meet a minimum length of twelve characters and comply with enforced complexity requirements. Password reuse is restricted through password history controls, and brute-force attacks are mitigated through automatic account lockouts after repeated failed login attempts. User sessions automatically expire after thirty minutes of inactivity, and all sessions are logged with associated IP addresses.
Role-Based Access Control
Access to data is granted strictly based on defined user roles. Support staff may access limited customer data only when assisting. Managers can view team-level activity, while administrators manage system configurations. Regular users are restricted to viewing only their own records. Access permissions are reviewed regularly and are automatically revoked when a team member leaves the organization.
Privileged Access Management
Sensitive operations require explicit approval and are granted only for limited durations. All privileged activities are fully logged, and immutable audit trails are maintained to support compliance and investigation requirements.
NETWORK SECURITY
RSoft Technologies protects its infrastructure through multi-layered firewalls, web application firewalls, intrusion detection systems, and automated DDoS mitigation mechanisms. Customer data is segregated from internal systems, development environments are isolated from production, and administrative systems are accessible only through restricted access controls. All remote access requires secure VPN connections and automated security checks before access is granted. API integrations are secured using securely generated API keys, rate limiting, OAuth 2.0 authentication, request signing, and comprehensive audit logging to prevent abuse and unauthorized access.
DATA CENTER SECURITY
RSoft Technologies operates on enterprise-grade dedicated infrastructure hosted within Tier IV standard data centers in Mumbai and Noida, recognized among Asia’s most secure data hosting environments. These facilities provide advanced physical security controls include layered access points, visitor management and tracking, background verification for authorized personnel, and continuous video surveillance. Environmental protections include climate control systems, redundant power supplies, fire suppression systems, water detection systems, and earthquake-resistant facility design.
DISASTER RECOVERY
In the event of a data center failure, RSoft Technologies maintains a recovery time objective of four hours and a recovery point objective of one hour. Customer data is replicated across multiple regions, and automatic failover mechanisms are designed to continue service with minimal disruption. Disaster recovery procedures are tested regularly to ensure effectiveness.
All backups include customer data such as leads, contacts, communications, configuration settings, call recordings, and system logs required for compliance.
APPLICATION SECURITY
All application code undergoes mandatory review before deployment and is continuously scanned using automated security tools to identify vulnerabilities. Dependency libraries are monitored for known security issues, and security patches are deployed promptly. Developers receive ongoing security training to ensure adherence to best practices. Production environments never use real customer data for testing purposes.
DATA BREACH & INCIDENT RESPONSE
RSoft Technologies continuously monitors its systems for security threats through real-time monitoring, alerting, vulnerability scanning, and audit logging. If a security incident is detected, immediate containment and investigation steps are initiated. Affected customers and regulatory authorities are notified when required, and remediation measures are implemented promptly. Post-incident reviews are conducted to strengthen future security controls.
COMPLIANCE
RSoft Technologies complies with the General Data Protection Regulation in Europe, including the availability of Data Processing Addendums, support for standard contractual clauses, data deletion rights, and data portability. The company adheres to the California Consumer Privacy Act through documented privacy policies and breach notification procedures. Compliance with Canada’s Anti-Spam Legislation ensures consent-based communications and sender identification. Indian data protection requirements are met under the Information Technology Act, 2000, with adherence to TRAI regulations and local data residency standards. The registered office is located in Chennai, Tamil Nadu.
EMPLOYEE SECURITY
All RSoft Technologies employees undergo employment history verification, reference checks, background checks as per company policy, and periodic security clearance reviews. Mandatory security training covers information security fundamentals, data protection and privacy, secure coding practices, and incident reporting procedures. Employees follow strict data handling, acceptable use, clean desk, confidentiality, and incident reporting policies. Policy violations result in corrective action, and security policies are reviewed and updated regularly.
THIRD-PARTY SECURITY
RSoft Technologies ensures that all service providers meet strict security and data protection requirements. Data processing agreements include confidentiality obligations, secure data handling practices, audit rights, and breach notification procedures. Customers are notified at least thirty days in advance of any sub-processor changes, and alternative options are provided upon request.
MONITORING & LOGGING
Comprehensive logging includes authentication events, data access and modification records, API activity, administrative actions, security alerts, and system errors. Active logs are maintained for compliance purposes, while archived logs are retained for audit requirements. All logs are encrypted, immutable, and regularly verified for integrity. Continuous monitoring and automated alerting help identify suspicious activity, including failed login attempts, unusual data access patterns, and unauthorized configuration changes. Immutable audit trails preserve complete activity records for investigation and compliance.
SECURE BY DEFAULT
All new accounts are created with secure default settings, including enforced session timeouts, strong password policies, automatic data encryption, activity logging, and multi-factor authentication availability. Customer data remains private by default, with no data sharing, third-party access, or data selling without explicit permission. Users can view login history, activity logs, connected devices, active sessions, integrated applications, and the most recent backup status at any time.
REGULAR SECURITY TESTING
RSoft Technologies performs continuous automated vulnerability scanning, real-time code security checks, dependency vulnerability assessments, configuration reviews, and automated patch deployment. Internal and external security audits are conducted regularly to verify compliance, identify risks, and implement improvements based on best practices.
DATA LIFECYCLE
Customer data is encrypted immediately upon entry into the system and securely stored in Yotta Mumbai. Real-time backups are maintained in secondary regions to prevent data loss. Users can access their data through secure, encrypted connections at any time. Deleted data is retained for a thirty-day safety window before permanent removal, and complete data deletion is performed upon account closure in accordance with the data deletion policy.
Customers may download their data, delete records, share access with team members, integrate third-party applications, and request additional copies at any time. RSoft Technologies does not read customer data, analyze sales pipelines, access communications, sell data, use customer data for purposes outside authorized operations, or directly or indirectly engage in any marketing activities involving customer data.
BUSINESS VALUE OF SECURITY
RSoft Technologies provides enterprise-grade data protection, global compliance standards, continuous security monitoring, encrypted data handling, and transparent security practices to customers. These measures help businesses build trust, reduce the risk of data incidents, meet regulatory requirements, and support high-value engagements. For investors, this security approach demonstrates strong risk management, operational excellence, customer retention capability, regulatory readiness, and scalable security practices.
FINAL COMMITMENT
RSoft Technologies protects customer data with the same care and rigor applied to its own information. Every customer receives consistent, enterprise-grade security protection regardless of company size or deal value.
Your data security is our responsibility. Your business trust is our commitment.