How we keep your data safe.

Who we are, in security terms

Desvelado Advisory Private Limited is a SEBI-registered Research Analyst (INH000028723). Under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), we are classified as a Self-certification Regulated Entity. We publish an annual self-assessment of our cybersecurity controls to SEBI and keep the underlying policy pack available for inspection.

What we protect

Your personal identifying information (name, address, email, phone), your KYC documents (PAN and Aadhaar — encrypted at rest under separate keys), your subscription and invoice records, your written correspondence with us, and the research we send you. We do not sell your data. We do not run behavioural profiling. We do not collect bank-account details — payments route through our payment vendor's vault and we see at most the last four digits.

The controls we operate

• Encryption. Every public and inter-service connection uses TLS 1.2 or higher. Your PAN, date of birth and Aadhaar are encrypted at rest with dedicated keys before they are written to our database. Backups are encrypted off-site.
• Access. Every staff member has a named account; access is role-based and reviewed. Sensitive actions (opening a KYC document, issuing an invoice, closing a grievance) require a second-factor code and leave an audit trail.
• Monitoring. We monitor the health of every production system every two minutes. Failures and anomalies alert our Chief Information Security Officer.
• Backup. Every production database is backed up daily, held off-site, and tested quarterly. A hot standby lets us recover in minutes if a primary host fails.
• Patching. Every release is scanned for known vulnerabilities before it ships; critical advisories block the release until fixed.

Incident reporting

If a cybersecurity incident affects Desvelado, we report it to SEBI and to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of becoming aware. Where personal data is affected, we also notify the affected person under the Digital Personal Data Protection Act, 2023.

Report a vulnerability (responsible disclosure)

If you have found a security weakness in our website, our client portal, our mobile app, or any Desvelado system, we would like to know. Please email security@desvelado.in (or grievance@desvelado.in if the first mailbox is unreachable) with:

• the URL or system affected;
• a short description of the issue and how to reproduce it;
• any proof of concept you can share safely (steps, HTTP requests, redacted screenshots).

Please do not:

• read, download or modify any data you are not authorised to access;
• run automated scanners or load-testing tools against our systems;
• publicly disclose the issue before we have had a reasonable opportunity to address it (we aim to acknowledge within 3 working days).

We do not currently run a bounty programme, but we recognise responsible disclosure in writing on request. Where the issue results in a change we ship, we are glad to credit you.

Standards and framework

Desvelado's internal cybersecurity policy pack covers the areas named in SEBI's CSCRF: governance, risk management, access control, encryption, patching, backup and recovery, logging, incident response, vendor risk, data classification, and acceptable use. The pack is reviewed at least annually by the Board and after every material change. It is not published here; it names our vendors, keys and operational detail, which are themselves sensitive. It is available for inspection by SEBI and, under confidentiality, by prospective institutional clients.

Contact

Chief Information Security Officer: Danish Aggarwal — danish@desvelado.in

Data Protection Officer / Grievance Officer: Ansh Jain — grievance@desvelado.in

Phone: +91-11-40846817 / +91-11-45635652 (Mon–Fri, 9:00–18:00 IST). Post: Desvelado Advisory Private Limited, Unit 502, 5th Floor, Plot A1, D Mall, Netaji Subhash Place, Pitampura, New Delhi 110034.