Security and data handling
Where data lives, how it is encrypted and who can read it.
Residency
On the pilot, the database, documents and backups run in Singapore (asia-southeast1) on Railway [verify Railway region list]. Cloudflare terminates TLS at the edge and caches only static assets. Firms that require India hosting can run on the Google Cloud profile in Mumbai with backups in Delhi. The contract is governed by the law of Nepal.
Encryption
Each firm has its own data-encryption key, wrapped by a key-management service. Documents are encrypted under that key before they reach storage; deleting the firm destroys the key so backups age out unreadable. TLS protects everything in transit.
Tenant isolation
One PostgreSQL database with row-level security on every tenant table; the runtime role cannot bypass it. A cross-tenant test suite runs on every deploy.
Audit
Every document download and every change is written to an audit log with actor, action, target, IP address and time. Admins can export it as CSV.