Compliance

01Our Approach

Transure handles sensitive financial data, so security and compliance are built into how we design and operate the platform. We aim to follow recognised standards, apply controls proportionate to risk, and improve our programme as regulations and best practices evolve.

Compliance is shared across our teams and reinforced through policies, training and regular review.

02Regulatory Framework

Depending on the features in use, our practices are designed to align with the frameworks relevant to a finance platform operating in India, including:

• RBI guidelines — applicable directions from the Reserve Bank of India relating to payments, data localisation, and the use of regulated banking partners.
• PCI DSS — the Payment Card Industry Data Security Standard, where card data is handled, typically through certified partners.
• SEBI regulations — where relevant to securities or investment-related activities.
• DPDP Act, 2023 — India's Digital Personal Data Protection Act, governing how we process personal data.
• IT Act, 2000 — and the rules issued under it, as applicable to electronic records and data security.

03Certifications

We are building out a formal certification programme. Our current status:

We will update this page as these assessments progress and reports become available to eligible customers under appropriate confidentiality terms.

04Security Controls

Core controls operating across the platform include:

• Encryption — AES-256 at rest and TLS 1.3 in transit for all data.
• Access control — role-based permissions with maker-checker enforcement and full SSO support.
• Immutable audit logs — every access and modification event is recorded, tamper-proof and exportable.
• AI fraud detection — real-time anomaly monitoring across NEFT, RTGS and IMPS rails before funds settle.
• Testing — regular vulnerability assessments and penetration testing.
• Incident response — protocols aligned with CERT-In reporting timelines.

05Data Residency

All financial and personal data of users is stored within data centres located in the Republic of India, in compliance with RBI data localisation guidelines. No financial transaction data or KYC records are transferred to or stored on servers outside India.

06Audit & Reporting

We maintain logging and monitoring designed to support internal and external audits. Access to sensitive systems is restricted, reviewed and recorded, and we retain records needed to meet audit and regulatory obligations.

Eligible customers may request available compliance documentation through their account contact, subject to confidentiality terms.

07Responsible Disclosure

We welcome reports from security researchers who identify potential vulnerabilities in our platform. If you believe you have found an issue, please report it to us privately and give us a reasonable opportunity to investigate and respond before any public disclosure.

Please avoid accessing or modifying data that is not yours and do not disrupt the service while testing. We will acknowledge valid reports and work to address confirmed issues promptly.

08Contact

For compliance enquiries or to report a security issue, please reach our team: