Data residency and DPDP compliance

Summary

All user data lives in asia-south1 (Mumbai) and the product operates under the Digital Personal Data Protection Act 2023 — single-region, consented, erasable, grievance-officered.

Why it matters

The audience is Indian filers handling PAN, bank, and salary data. DPDP §8 minimisation and §13/§14 user rights (correction, erasure, grievance) are not optional, and a multi-region footprint would multiply the sub-processor surface beyond what a one-team V1 can defend in a regulator audit. Pinning Firebase, Cloud Functions, and Firestore to a single Indian region collapses the residency story to one sentence.

Implications

• Firebase + Cloud Functions + Firestore all pinned to asia-south1. No multi-region failover.
• Grievance officer desk lives on the admin pillar with a statutory 30-day response deadline.
• Audit log retained 7 years.
• User can withdraw consent and trigger erasure — every collection must be erasure-walkable.
• Every sub-processor (storage, email, payments, analytics) must be enumerated and consented to before sign-up — see infra-sub-processors.
• No transfer of personal data outside India in V1.
• ToS and Privacy URLs always served from chitragupt.ai.

Related

• upload-only — minimisation in practice (we hold only what the user uploaded)
• infra-sub-processors — the canonical sub-processor list users consent to
• onboarding-consent — where DPDP consent is captured
• 2026-05-30-foundational-region-asia-south1 — the region pin decision
• architecture-rules — the broader infra rules this sits inside

Sources

• .context/wiki/concepts/* § "Hard constraints (V1)" — region row, DPDP row
• .context/wiki/concepts/* § "Core principle — read-only review platform" — DPDP §8 minimisation rationale