Your society's data is
safe with us
GateWise is built with bank-grade security from the ground up. All data stored in India, encrypted end-to-end, access-controlled by role, and backed up every 6 hours.
Security built into every layer
Not bolted on after — designed in from day one. Here's how we protect every byte of your society's data.
India-only data storage
All data lives exclusively on Oracle Cloud Mumbai. No data crosses Indian borders. No foreign sub-processors for production data. Fully compliant with DPDP Act 2023 data localisation expectations.
AES-256 encryption at rest
Every database record, file, and document is encrypted at rest using AES-256. Encryption keys are managed with automatic annual rotation. Backups are encrypted with a separate key.
TLS 1.3 in transit
All traffic between your browser, PWA, and our servers uses TLS 1.3 — the highest available standard. Older TLS 1.0 and 1.1 connections are rejected. Certificate auto-renewal via Let's Encrypt.
Role-based access control
Granular RBAC ensures guards can't see financial data, residents can't see other flats' records, and committee members only see what their role requires. Every permission is audited.
6-hour encrypted backups
Automated encrypted backups run every 6 hours to a geographically separate region. Point-in-time recovery available for the last 35 days. RTO <4 hours, RPO <6 hours.
Audit log on every action
Every user action — bill edit, payment record, gate entry, NOC approval — is logged with timestamp, user ID, and IP address. Audit log is immutable and available to committee admins.
Penetration testing
Annual third-party penetration testing by a CERT-In empanelled security firm. All critical and high findings are remediated before the next billing cycle. Reports available to Enterprise customers on request.
Multi-factor authentication
OTP-based two-factor authentication for all committee admin logins. Guard app logins use device-bound credentials with biometric unlock. Suspicious login alerts sent via WhatsApp instantly.
VPC isolation & WAF
All backend services run in a private VPC with no direct internet exposure. A Web Application Firewall blocks OWASP Top 10 attacks, SQL injection, and DDoS attempts at the edge.
Bank-grade data protection built for Indian societies
We treat your society's financial data like our own.
Oracle Cloud Mumbai
All data stored in India's premier cloud region with enterprise-grade isolation.
AES-256 encryption
Data at rest and in transit encrypted with industry-standard AES-256.
DPDP Act 2023 compliant
Built-in compliance for Indian housing societies.
Data residency
All resident data stays within India. No cross-border transfers.
Right to erasure
Residents can request data deletion through the admin portal.
Compliant with Indian law
GateWise is designed and operated in compliance with all applicable Indian data protection and financial regulations.
Privacy policy summary
Plain language. No legalese. Here's exactly what we do with your society's data.
What data we collect
- Flat register: flat number, owner/tenant name, phone, email
- Financial records: bill amounts, payment transactions (no raw card data)
- Gate logs: visitor name, flat, entry/exit time, guard photos
- Maintenance: ticket descriptions, photos, resolution notes
- Usage analytics: anonymised platform feature usage (no PII)
What we never do
- We never sell, rent, or share resident data with third parties for marketing
- We never store raw Aadhaar numbers or biometrics
- We never allow GateWise employees to access your data without your explicit request and audit-logged approval
- We never use your data to train AI models without explicit consent
Your rights under DPDP Act 2023
As a data principal, residents have the right to: access their personal data held by GateWise, correct inaccurate data, request data deletion, and nominate a person to exercise these rights on their behalf. Requests are honoured within 72 hours via [email protected].
Data retention
Active subscription: data retained indefinitely. After cancellation: read-only for 30 days, then permanently deleted from all servers including backups within 60 days. You can export all data at any time in Excel/CSV format.
Third-party processors
We use: Oracle Cloud Mumbai (hosting), Razorpay (payments), SMS gateway, Firebase (push notifications), and Meta Business API (WhatsApp). All processors are contractually bound to our data protection standards and do not use your data independently.
Payment and refund terms
- Payment methods: All major credit/debit cards, UPI apps (GPay, PhonePe, Paytm, BHIM), net banking (100+ banks), and NEFT/RTGS transfers.
- Refund policy: Yearly subscriptions are non-refundable after 30 days. Within 14 days of trial, cancel anytime with full refund. Contact support for billing questions.
- GST: All prices include 18% GST. GST invoices issued monthly for records.
- Payment gateway fees: Gateway transaction fees (1.8–2% + GST) are charged by the payment processor directly to your bank, not added to your GateWise invoice.
- Trial: No payment method required. After 14 days, your account enters read-only mode until subscription payment.
Platform limitations & committee responsibility
- Committee accountability: GateWise provides software tools only. The society committee remains fully responsible for financial decisions, member records, visitor approvals, and regulatory compliance as required under the respective State Cooperative Societies Act.
- Data accuracy: We do not verify resident data entered by the society. The committee must ensure resident information is accurate and current. GateWise is not liable for incorrect billing due to outdated member data.
- Gate access decisions: Visitor approvals and gate entry decisions are made by society guards/committee. GateWise provides the digital tools only and is not responsible for unauthorized entry or security incidents.
- Digital records: Electronic records in GateWise satisfy IT Act requirements but may need physical backup as required by your society's byelaws. Check with your managing committee.
- Limitation of liability: GateWise's liability is limited to the subscription amount paid in the preceding 12 months. We do not compensate for indirect losses, lost collections, or security incidents.
Service provider indemnity
- No independent fiduciary role: GateWise does not act as auditor, accountant, legal advisor, or guarantor. We provide software as a service.
- Regulatory changes: GST rates and society regulations may change. GateWise updates software promptly but the committee must verify compliance before statutory filing deadlines.
- Payment gateway: GateWise integrates with RBI-licensed payment aggregators. Payment success/failure is the gateway's responsibility, not ours.
- Force majeure: We are not liable for service interruptions caused by events beyond our control (natural disasters, internet outages, government restrictions, or third-party failures).