Trust Center

1.1 Infrastructure Security.

(a)Cloud Hosting: Our platform is hosted on secure, accredited cloud infrastructure providers located in approved jurisdictions (currently in India, Singapore) that maintain industry-standard certifications for physical and network security.

(b)Network Protections: We implement firewalls, intrusion detection and prevention systems (IDPS), distributed denial-of-service (DDoS) mitigation, and network segmentation to limit attack surfaces.

(c)Data Centres: Our cloud providers maintain state-of-the-art data centres with redundant power, climate control, 24/7 monitoring, biometric access controls, and video surveillance.

(d)Encryption in Transit: All data transmitted between users and our platform is encrypted using TLS 1.2 or higher (HTTPS). We enforce secure connections (HSTS) and disable obsolete protocols.

(e)Encryption at Rest: Sensitive data categories (including mobile numbers, transcripts, facial expression scores, and UPI IDs) are encrypted at rest using AES-256-GCM, a strong industry-standard encryption algorithm. Non-sensitive data is encrypted at the storage volume level.

1.2 Application Security.

(a)Secure Development Lifecycle: We follow a secure software development lifecycle (SDLC) that includes threat modelling, static code analysis, dynamic scanning, and peer reviews before any code is deployed to production.

(b)Authentication and Session Management: We use JSON Web Tokens (JWT) stored in HTTP-only, SameSite=Strict cookies to prevent cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. Session timeouts are enforced across all portals based on user role and risk profile.

(c)Password Security: Passwords are securely hashed using industry-standard cryptographic techniques and are never stored in plaintext. We also screen passwords against known breached password databases using a privacy-preserving method (k-anonymity) — your full password never leaves your device.

(d)Rate Limiting and Brute Force Protection: We implement rate limiting, account protection mechanisms, and anomaly detection controls on sensitive operations (including login, registration, OTP requests, and UPI verification) to mitigate brute-force attacks, credential stuffing, and other abusive activity.

(e)Input Validation and Sanitisation: We validate and sanitise all user inputs to prevent injection attacks (SQL injection, command injection, cross-site scripting).

(f)API Security: Our APIs require authentication, enforce least-privilege access controls, and are protected against parameter tampering and replay attacks.

(g)Security Headers: We implement security headers including Content Security Policy (CSP), X-Content-Type-Options, X-Frame-Options (DENY), and Referrer-Policy to mitigate common web vulnerabilities.

(h)Audit Logging: We maintain comprehensive audit logs of authentication events, data access, administrative actions, and security-relevant events.

1.3 Operational Security.

(a)Access Control: Access to production systems is restricted to authorised personnel based on the principle of least privilege. Multi-factor authentication (MFA) is required for all administrative access.

(b)Vendor Risk Management: We conduct due diligence on all third-party service providers before engagement. Each provider signs a data processing agreement that mandates compliance with applicable data protection laws and security standards.

(c)Incident Response: We maintain a documented incident response plan that includes detection, containment, eradication, recovery, and notification procedures. We periodically review and test our response readiness.

(d)Business Continuity and Disaster Recovery: We maintain backups and have documented recovery procedures to ensure platform availability and data integrity in the event of a system failure or disaster.

(e)Regular Security Assessments: We periodically assess our systems for security vulnerabilities through a combination of automated and manual review processes and engage independent professionals for security assessments. Remediation is prioritised based on risk severity.

(f)Employee Training: All employees receive mandatory security and privacy training. Developers receive additional training on secure coding practices.

1.4 Current Certifications and Roadmap.

Rik.ai intends to pursue recognised security certifications, including ISO 27001 and SOC 2, as the organisation matures and customer requirements evolve. In the interim, we operate under industry-standard security practices as described above.

2.1 Our Privacy Principles.

(a)Data Minimisation: We collect only the personal data that is necessary for the specific purpose for which it is processed.

(b)Purpose Limitation: We use personal data only for the purposes disclosed at the time of collection, or for purposes that are compatible with those original purposes.

(c)Transparency: We provide clear, accessible, and understandable privacy notices (Privacy Policies) for each of our portals – marketing website, customer portal, and participant portal.

(d)User Control: You have rights to access, correct, delete, and withdraw consent for your personal data. We provide mechanisms to exercise these rights.

(e)Data Security: We implement strong technical and organisational measures to protect personal data.

2.2 Data Processing Roles (Under DPDP Act 2023).

2.3 Data Collection and Use Summaries.

2.4 Data Subject Rights.

We respect the rights of Data Principals under the DPDP Act 2023:

(a)Right to access your personal data;

(b)Right to correction of inaccurate data;

(c)Right to deletion (subject to legal retention requirements);

(d)Right to withdraw consent;

(e)Right to grievance redressal;

(f)Right to nominate a representative.

To exercise these rights, please contact our Grievance Officer: Partha Roy, Founder & Grievance Officer at contact@rikai.tech.

2.5 Third-Party Sub-processors.

The following reflects the major sub-processors currently engaged by Rik.ai to operate our platform. Each is bound by a data processing agreement, and this list is maintained and updated as changes occur.

2.6 International Data Transfers.

Some of our sub-processors are located outside India (primarily the United States). When personal data is transferred outside India, we rely on:

We take steps to ensure that any cross-border data transfer provides an adequate level of protection comparable to that required under the DPDP Act.

2.7 Data Retention.

Different categories of data are retained for different periods:

3.1 Our AI Principles.

(a)Human-Centred Design: AI interactions are structured to encourage honest, voluntary, and thoughtful responses from participants. AI does not make decisions about participants (e.g., payout eligibility) without human review where needed.

(b)Transparency: We clearly communicate when an AI is being used. Participants are informed before any interview that they will be interacting with an AI interviewer. Customers are informed that reports are AI-generated.

(c)Accuracy and Limitations: We acknowledge that AI-generated outputs may contain inaccuracies, omissions, biases, or analytical artefacts. We do not present AI outputs as infallible or as a substitute for human judgment.

(d)Data Privacy: AI processing uses participant data only for the purposes of conducting the specific survey and generating research insights. Customer Data and Participant Data processed through third-party AI services are used solely to provide the requested functionality and are not provided for the purpose of training Anthropic's foundation models. We do not use Customer Data to train proprietary or third-party foundation models unless expressly authorised in writing by the Customer.

(e)Human Oversight: Critical decisions (e.g., fraud review for referrals, disputed session quality) involve human review. Customers are advised to review AI-generated insights alongside human judgment.

3.2 AI Features.

(a)AI Interviewer (Multiple Personas): Our AI agents (Jal – Empathy, Vayu – Discovery, Agni – Insight, Prithvi – Clarity, Aakash – Reflection) conduct structured interviews, ask follow-up questions based on participant responses, and adapt conversation flow.

(b)Sentiment Analysis: We use Google Cloud Natural Language API to compute sentiment scores (positive, neutral, negative) from participant transcripts.

(c)Facial Expression Analysis (video surveys only, with explicit consent): We use Google Cloud Vision API to derive engagement-related analytical metrics. Raw frames are deleted immediately after analysis.

(d)Automated Theme Extraction: The AI identifies recurring themes, patterns, and anomalies across participant responses.

(e)"Ask Rishi" (Customer Portal): Customers can ask natural language questions about their survey data, and the AI provides answers based on aggregate, anonymised data.

(f)Aggregate Report Generation: The AI generates executive summaries, key findings, and strategic recommendations from survey data.

3.3 AI Limitations and Disclaimers.

(a)AI-generated outputs may not be complete, accurate, or suitable for every purpose.

(b)The AI may reflect biases present in its training data. We take reasonable steps to mitigate bias but cannot guarantee bias-free outputs.

(c)Rik.ai does not provide legal, financial, medical, investment, or professional advice through any AI feature. Customers and participants should consult qualified professionals for such advice.

(d)AI is not a substitute for human judgment, especially in high-stakes decisions.

3.4 Participant Consent for AI.

4.1 Regulatory Framework.

Rik.ai aligns its practices with:

(a)Digital Personal Data Protection Act, 2023 (DPDP Act) – India's comprehensive data protection law;

(b)Information Technology Act, 2000 (and associated rules, including the SPDI Rules);

(c)Industry standards for security and data protection (ISO 27001, SOC 2 – in progress);

(d)Emerging AI governance frameworks and best practices.

4.2 Legal Basis for Processing.

We process personal data only on valid legal grounds under the DPDP Act:

4.3 Grievance Redressal.

We have appointed a Grievance Officer as required under the DPDP Act and IT Rules:

If you are not satisfied with our resolution, you may escalate to the Data Protection Board of India once constituted.

4.4 Third-Party Assessments.

We engage independent security and privacy professionals to conduct assessments, audits, and penetration tests periodically. While we are not currently certified, we have implemented a range of security, privacy, and governance controls designed to support future certification efforts.

Rik Technologies

Email: privacy@rikai.tech
Website: https://rikai.tech