Compliance

9thSense is built and operated by Digio, a regulated digital identity company serving banks, NBFCs, and financial institutions across India.

SOC 2

9thSense inherits SOC 2 compliance from Digio. Digio's infrastructure and security practices have been independently audited against the SOC 2 Trust Services Criteria, covering:

• Security — Protection against unauthorized access
• Availability — System availability for operation and use
• Confidentiality — Protection of confidential information

To request a copy of the SOC 2 report, contact your account manager or email security@9thsense.ai.

Data residency and multi-region deployment

For organizations with strict data residency requirements — particularly financial institutions operating under RBI guidelines or organizations that must keep customer data within India — 9thSense supports:

Self-hosted deployment

Deploy the complete 9thSense platform stack within your own infrastructure. In this configuration:

• All data is stored in your own database and object storage
• All AI inference runs on your own compute
• No data leaves your network

Self-hosted deployment is the recommended path for organizations with strict data residency requirements.

Multi-region cloud deployment

For organizations using the managed service, deployment region selection is available to ensure data is stored and processed in a specific geography.

Contact your account manager to discuss region options for your account.

Shared responsibility model

Security responsibilities are divided between 9thSense and you as the customer.

9thSense is responsible for

• Physical and logical security of managed infrastructure
• Encryption of data at rest and in transit
• Patching and hardening of platform components
• Authentication system integrity (key hashing, RBAC enforcement)
• Audit logging
• Availability and uptime of managed services
• SOC 2 compliance of the platform layer

You are responsible for

• Securing your API keys — do not commit them to source control or expose them in client-side code
• Controlling which personnel have access to API keys and with what scopes
• Validating webhook signatures when receiving events from 9thSense
• Configuring retention policies appropriate to your compliance obligations
• Assessing whether the allow_cloud flag is permissible under your data governance policies
• Security of your own infrastructure in self-hosted deployments

API key security

API keys provide full programmatic access to your tenant's data. Follow these practices:

• Store keys in environment variables or a secrets manager, never in source code
• Issue separate keys per application or environment (production, staging, dev)
• Use the minimum required scope for each key (read where write is not needed)
• Rotate keys promptly if you suspect a compromise — revoke the old key in Settings → API Keys

Requesting security documentation

For enterprise security reviews, vendor assessments, or compliance questionnaires, contact security@9thsense.ai with:

1. Your organization name and account details
2. The specific documentation or questionnaire you need completed
3. Any deadline or timeline

We typically respond to security documentation requests within 5 business days.