Data Protection & Security Policy

Welcome to Fin 100X.AI — India’s First Protocol-Governed AI Financial Operating System. By using our app or platform, you agree to the following terms:

1. Introduction Fin 100X.AI (“we,” “our,” “us”) is India’s first protocol-governed AI Financial Operating System, committed to empowering Youth, Gen Z, Gen Alpha, and first-time earners with financial dignity, security, and freedom. Given the sensitive nature of financial and personal data we handle, this Data Protection & Security Policy (“Policy”) establishes: Our data protection principles and governance framework. Security controls implemented to safeguard user data. Incident response obligations in compliance with CERT-IN directives. Our regulatory obligations under RBI, SEBI, IRDAI, and PFRDA.

This Policy is binding on all employees, advisors, contractors, partners, and third parties who access or process Fin 100X.AI data.

2. Scope of Policy This Policy applies to: All users of Fin 100X.AI’s platform (mobile app, website, APIs, SDK integrations). All data collected, processed, or stored, including personal data, financial data, KYC records, and transaction histories. All systems and networks used for data storage and processing. All licensed partners and third-party service providers integrated with Fin 100X.AI.
3. Data Protection Principles Fin 100X.AI adheres to the following global and Indian data protection principles:
4. Lawful & Fair Processing – All data is processed lawfully, fairly, and transparently.
5. Purpose Limitation – Data is collected only for legitimate purposes, informed to the user.
6. Data Minimization – Only data necessary for service delivery is collected.
7. Accuracy – Data is kept accurate and up-to-date.
8. Storage Limitation – Data is retained only for the duration required by law.
9. Integrity & Confidentiality – Data is protected using strong encryption and access controls.
10. Accountability – We maintain audit logs, records of processing, and compliance reports.
11. Data Classification We classify data into the following categories: Public Data – Content intentionally made public. Internal Data – Non-sensitive operational data. Confidential Data – Business processes, financial models. Sensitive Personal Data – Aadhaar, PAN, bank details, KYC records. Regulated Financial Data – Credit scores, insurance policies, investment holdings.

Special protections apply to Sensitive Personal Data and Regulated Financial Data.

5. Data Collection & Storage Data is collected in compliance with DPDP Act 2023 and sectoral laws. All data is stored on India-based servers as per RBI data localization directives (2018). Encryption at rest – AES-256 standard. Encryption in transit – TLS 1.3 with Perfect Forward Secrecy. Tokenization – Payment card and sensitive identifiers are tokenized.
6. User Rights Users have the following rights under DPDP Act 2023:
7. Right to Access – Obtain copies of personal data.
8. Right to Correction – Request correction of inaccuracies.
9. Right to Erasure – Request deletion of data, subject to legal retention obligations.
10. Right to Consent Withdrawal – Opt-out of data processing (non-regulatory).
11. Right to Portability – Request data in machine-readable format.
12. Right to Grievance Redressal – Approach our Grievance Officer.
13. Security Controls We implement defense-in-depth security architecture, including: 7.1 Physical Security Data centers are ISO 27001, SOC 2 certified. Biometric and RFID access controls. 24x7 CCTV monitoring.

7.2 Network Security Firewalls, IDS/IPS systems. Zero Trust Network Architecture (ZTNA). VPN + MFA for employee access.

7.3 Application Security Secure coding practices (OWASP Top 10). Regular penetration testing & VAPT (as per CERT-IN). API authentication using OAuth 2.0 + JWT.

7.4 Data Security Role-based access controls (RBAC). Data masking for test environments. Automated anomaly detection for fraud and breaches.

8. Incident Response & Breach Notification All incidents are reported to CERT-IN within 6 hours (as per April 2022 directive). Users are notified of material breaches within 72 hours. Incident Response Team (IRT) conducts root cause analysis and remediation. Records of all incidents are preserved for 180 days.
9. Third-Party & Vendor Management All third parties undergo security due diligence before onboarding. Vendors must sign Data Processing Agreements (DPAs). Regular audits ensure compliance with RBI/SEBI/IRDAI/PFRDA regulations.
10. Fraud Protection & Monitoring Real-time fraud detection engine integrated. Behavioral anomaly detection (sudden high-value transactions, location mismatches). Compliance with RBI Ombudsman Scheme for fraud complaints. Fraud Shield Module operates with CERT-IN, RBI, and SEBI-aligned guardrails.
11. Data Retention & Disposal KYC Data – Retained for 10 years (per PMLA rules). Insurance Records – Retained for 7 years (per IRDAI guidelines). Investment Data – Retained as per SEBI (Mutual Funds) Regulations, 1996. Secure disposal: cryptographic erasure + DoD 5220.22-M overwrite.
12. Regulatory Alignment RBI – Cyber Security Framework for NBFCs, Data Localization Circular 2018. SEBI – Cyber Security & Cyber Resilience Framework (2015, 2022). IRDAI – Guidelines on Information & Cyber Security (2017). PFRDA – IT & Security Guidelines for NPS architecture. CERT-IN – Incident Reporting Directions (2022).
13. Roles & Responsibilities Chief Information Security Officer (CISO) – Overall security governance. Data Protection Officer (DPO) – Compliance with DPDP Act. Incident Response Team (IRT) – Handles breaches and incidents. All Employees – Mandatory data security training & NDA compliance.
14. Grievance Redressal Users may raise concerns related to data protection/security at:

Email: legal@fin100x.ai Helpline: +91-XXXXXXXXXX Grievance Officer: [Name], [Designation] Complaints are resolved within 30 days, per DPDP Act and RBI Ombudsman guidelines.

15. Enforcement & Liability Violations of this Policy by employees/partners will result in disciplinary action including termination. Users affected by security breaches are entitled to remedies under DPDP Act 2023, IT Act 2000, and Consumer Protection Act 2019. Disputes resolved by arbitration under Arbitration & Conciliation Act, 1996, seated in Mumbai.
16. Policy Updates This Policy is reviewed annually or upon regulatory changes. Updates will be published on our website/app with effective date.

Annexures Annexure A – Sample Data Breach Notification (to Users)

Subject: Urgent: Data Security Incident NotificationDear [User Name],We regret to inform you of a security incident involving your personal data on [date]. Immediate actions have been taken to contain the breach. You may take the following steps to safeguard your account: [steps].

For assistance, contact legal@fin100x.ai.

Annexure B – CERT-IN Reporting Template (per 2022 Directions) Nature of Incident Affected Systems Date/Time of Detection Root Cause Mitigation Steps Contact Details of Reporting Officer

Annexure C – User Awareness Do’s & Don’ts Enable 2FA/MFA on your account. Update passwords regularly. Do not share OTPs or account details. Do not click on suspicious links. DPDP Act + RBI/SEBI/IRDAI/PFRDA + CERT-IN compliant Website + App-ready legal format

#5 Data Protection & Security Policy (CERT-IN, RBI, SEBI, IRDAI, PFRDA aligned) This one will cover: Encryption standards (AES-256, TLS 1.3, etc.) Data residency (India servers, RBI storage circulars) Incident response & breach notification (CERT-IN guidelines, 6-hour rule) Secure KYC handling (CKYC/DigiLocker APIs) Access controls, logging, and monitoring Fraud detection, anomaly alerts, and cyber risk management Annexures: Sample breach notification template, CERT-IN reporting format

This is the regulatory backbone policy for Fin 100X.AI — without it, compliance for NBFC/InsurTech/WealthTech APIs won’t be airtight.