Privacy Policy

1. Overview & Information We Collect

AuthSetu ("we", "us", or "our") is an API-first developer identity and authentication platform. This Privacy Policy applies to all services, SDKs, developer dashboards, and APIs provided under AuthSetu.

We collect information provided directly by developers and end-users, including:

• Account Credentials: Email addresses, names, hashed passwords, and OAuth profiles.
• Application Telemetry: API access logs, IP addresses, user-agent headers, rate limit metrics, and authentication timestamps.
• Billing Data: Payment methods, invoice records, and tax identifiers processed via PCI-compliant payment processors.

2. How We Use Information

We process your information strictly for legitimate operational purposes:

• Providing, securing, and scaling authentication APIs and SDK endpoints.
• Detecting brute-force attacks, credential stuffing, anomaly events, and unauthorized access.
• Fulfilling compliance obligations (e.g., GDPR, SOC2, Aadhaar/PAN validation rules where applicable).
• Sending critical operational alerts, security notices, and system status updates.

3. Data Security & Storage

Security is paramount at AuthSetu. We implement strict zero-trust security controls:

• Encryption at Rest & Transit: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 GCM.
• Zero Plaintext Passwords: Passwords and API secrets are never stored in plaintext. We utilize Argon2id / bcrypt hashing with unique per-tenant salts.
• Isolated Databases: Enterprise tenants benefit from isolated data schemas and encrypted key management.

4. Data Retention & Erasure

We retain personal data only as long as necessary to fulfill active subscriptions or regulatory requirements. When an account or tenant is deleted, soft-deleted data is permanently expunged within 30 days from primary storage and backups.

5. Contact Privacy Office

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact our Data Protection Officer at: