Security Architecture

Built for Enterprise Security

Defense-in-depth security architecture designed for sensitive mental health data. Privacy by design, security by default.

Defense in Depth

Security Layers

Multiple layers of security protect your organization's data at every stage.

Encryption

Industry-standard encryption protects data at every stage

AES-256 encryption for data at rest
TLS 1.3 for data in transit
Zero-knowledge encryption for chat messages
Secure key management (AWS KMS)

Infrastructure

Secure, compliant cloud infrastructure

AWS Mumbai region (ap-south-1)
SOC 2 Type II certified data centers
Network isolation with VPC
DDoS protection via AWS Shield

Authentication

Secure identity management

JWT-based authentication
Anonymous sessions for employee privacy
Device fingerprinting (optional)
Session timeout controls

Access Control

Principle of least privilege

Role-based access control (RBAC)
HR sees only aggregate data
No employee-level access for employers
Audit logging for all access

Data Flow

How Data Moves Securely

Understanding the complete data lifecycle from employee access to HR insights.

Employee Access

Employee enters Company Code via browser (HTTPS)

TLS 1.3 encrypted connection

Anonymous Session

Session created without personal identifiers

No email or name required

Conversation

Chat with Mithra AI, stored encrypted

AES-256 encryption, zero-knowledge

Aggregation

Mood data aggregated at department level

Min 5 users for any data point

HR Dashboard

HR views aggregate insights only

No individual data exposed

Privacy Architecture

Zero-Knowledge Design

Our architecture ensures that even MannSetu cannot associate chat content with specific employees when they use anonymous mode.

Device-based session tokens, no PII required
Encrypted chat logs, keys not shared with employer
Aggregate insights only at 5+ user threshold
24-hour delay on crisis alerts for anonymity

Data Isolation

Organization A

Encrypted & Isolated

Organization B

Encrypted & Isolated

Multi-tenant architecture with strict data isolation

Operational Security

Security Practices

Regular Security Assessments

Quarterly vulnerability scans and annual penetration testing by third-party firms.

Incident Response

Documented incident response plan with 24-hour notification for security breaches.

Data Retention

Configurable retention policies. Default 90 days for conversations, 1 year for aggregate data.

Backup & Recovery

Daily encrypted backups with point-in-time recovery. RPO: 1 hour, RTO: 4 hours.

Have Security Questions?

Our security team is available to answer your questions, complete security questionnaires, and provide detailed documentation.

Zero-Knowledge Design

Our architecture ensures that even MannSetu cannot associate chat content with specific employees when they use anonymous mode.

Device-based session tokens, no PII required

Encrypted chat logs, keys not shared with employer

Aggregate insights only at 5+ user threshold

24-hour delay on crisis alerts for anonymity