Security and compliance

Facts about how SwasthyaGrid stores, protects, and handles data.

Data residency

Storage location

All data is stored on servers located in India.

Cloud provider

Infrastructure is hosted on a Meity-empanelled cloud service provider.

Data transfer

No personal or facility data is transferred outside India.

What is collected

Assessment responses, compliance scores, evidence attachments, user actions, and audit logs.

Patient data

The platform does not collect, store, or process patient health records or personally identifiable patient information.

Facility data

Facility names, locations, and assessment results are stored as part of the quality management function.

Authentication

All users authenticate with a unique credential. Shared or generic logins are not permitted.

Role-based access

Access to facility, district, and state data is controlled by role. Users see only the data their role permits.

Session management

Sessions expire after a configurable period of inactivity.

Logging

Every user action — login, assessment submission, data edit, export — is logged with a timestamp and user identity.

Immutability

Audit logs cannot be edited or deleted by any user, including administrators.

Retention

Audit logs are retained for a minimum of five years.

Export formats

Assessment data can be exported in CSV and PDF formats at any time.

No lock-in

Customers can export their complete data set at any time. There is no fee for data export.

Deletion

On contract termination, customer data is deleted within 30 days of a written request.

ISO 27001

Certification in progress. Target date: Q2 2027.

DPIIT recognition

Application in progress.

GeM registration

Registration in progress.

Write to us at [email protected] with any specific questions about data handling, security architecture, or compliance requirements.