Security
Where elan1 runs, how the write credential works, how evidence is protected, our role under India\u2019s DPDP Act, and how to report a vulnerability.
elan1 runs in AWS ap-south-1 (Mumbai) across three availability zones. Each residency domain has its own database and Ed25519 signing key, and proof records never leave the domain they were written in. Gulf and EU domains open only on a signed contract. No US region is offered.
01Residency
Data and evidence stay in the residency domain they were written in.
Facts
Each fact below holds for every hosted deployment of elan1 Govern, Work, Decide and Run. Customer-operated deployments run in your own environment.
Data flow, one governed write
Diagram: one governed write inside residency domain “in”, from intent to proof record. Proof records stay in the residency domain they were written in.
02Write path
The controls that matter most sit on the write path, so they fail closed.
03Keys, subprocessors and the review pack
When any of this changes, this page and its change log say how, before the change takes effect.
| Item | How it works |
|---|---|
| Where proof records live | In the residency domain they were written in. They never leave it. |
| Signing keys | One Ed25519 signing key per residency domain, used for L2 Attested records. |
| Key custody | Set out in the security review pack, with how a key is rotated. |
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database and storage for residency domain “in” | ap-south-1 (Mumbai) |
Any addition is logged on this page first, before it processes customer data.
In the security review pack
No penetration test summary is published yet. When one is, it is listed here with its date.
04India DPDP Act, 2023
Under the Digital Personal Data Protection Act, 2023, who decides why personal data is processed is the Data Fiduciary; who processes it on their behalf is a Data Processor. Our role depends on whose data it is and who runs the deployment.
Hosted deployments
Data Processor
For personal data in customers' systems that elan1 processes on the customer's instructions through elan1 Govern, Work, Decide and Run (hosted deployments), the customer is the Data Fiduciary and ELAN1 AGENTIC TECHNOLOGIES PRIVATE LIMITED acts as its Data Processor, under a data processing agreement.
Our own purposes
Data Fiduciary
For personal data elan1 collects for its own purposes (website visitors, contact and design-partner forms, account administration, billing, our own staff and marketing), elan1 is the Data Fiduciary.
Customer-operated
Neither, unless you grant support access
In customer-VPC, on-premises and sovereign deployments that the customer operates, elan1 does not process the personal data and is neither, except for any support access the customer grants, where it acts as Processor.
Legal notices and any legal action under the DPDP Act, 2023, including correspondence with the Data Protection Board of India, are handled by Hariharan (hariharan@elan1.ai), who is also our grievance officer.
05Report a vulnerability
We read every report, whether it concerns this website or an elan1 service. A person replies within 2 working days.
Please include
Please don’t
We acknowledge a report within 2 working days, tell you what we found, and tell you when it is fixed. Incident notification terms for customers are in the security review pack.
06Versions
Launch: residency and write-path controls now describe the running service. Added our role under the DPDP Act, keys and evidence, the security review pack and the reporting address elango@elan1.ai.
Owner decision, 10 Oct 2026: all four platforms launched.
Security page published: residency, write-path controls, key questions and the reporting contact.
First public version.
When a claim, a level or a price changes, the change is logged here with the reason. Earlier versions stay readable; history is never edited in place.
07FAQ
In India: AWS ap-south-1 (Mumbai), across three availability zones, in residency domain “in”. Data and proof records stay in the residency domain they were written in. Gulf and EU domains open only on a signed contract, and no US region is offered.
Each residency domain has one Ed25519 signing key, used to sign L2 Attested records. Key custody and how a key is rotated are set out in the security review pack, which you can request from the contact page.
Write to elango@elan1.ai; the address is also listed in /.well-known/security.txt. Include the page, endpoint or file affected and the steps to reproduce. A person acknowledges your report within 2 working days and tells you when it is fixed.
// SECURITY REVIEW
We walk your team through the write path, the residency domain and our DPDP role, and send the security review pack.