BBPS CA
Menu
Log in

Trust & security

BPS CA security

BPS CA is listed on the CSA STAR Registry at Level One (CAIQ v4.0.3 self-assessment) and protects each company's data with row-level isolation, admin MFA, and encryption in transit and at rest.

Last updated: 21 September 2026 · BPS FutureTech (OPC) Private Limited

CSA STAR Level One

BPS CA is listed on the Cloud Security Alliance STAR Registry at Level One (CAIQ self-assessment). Listed since 14 September 2026. Download CAIQ Self-assessment v4.0.3 from the BPS CA service listing. Level One requires annual resubmission; next renewal target 14 September 2027.

Our posture

BPS FutureTech (OPC) Private Limited operates BPS CA as a multi-tenant SaaS with tenant isolation (PostgreSQL RLS on core ledgers), TLS 1.2+ in transit, Argon2id password hashing, database-backed sessions, and role-based access. Legal operations are based in Chennai, India; primary compute runs on Oracle Cloud Infrastructure region ap-hyderabad-1 (Hyderabad, India).

Primary data volumes, boot disks, and object stores use OCI-managed provider encryption at rest (AES-256). Offsite disaster-recovery archives use AES-256-CBC. We do not claim custom application-layer encryption of the PostgreSQL database engine beyond provider-managed volume encryption.

We commission an annual third-party VAPT from a CERT-In empanelled firm in accordance with our internal security policy; the first assessment is scheduled for Q4 2026.

Authentication

Admin and Super Admin accounts must use password, email OTP, and authenticator MFA (TOTP) with one-time backup codes in production. Accountant and client portals use password plus email OTP only. WebAuthn/passkeys and mobile device management are not offered.

Residency & recovery

Primary application, database, and MinIO storage run on Oracle Cloud Infrastructure region ap-hyderabad-1 (Hyderabad, India). Encrypted disaster-recovery archives are stored on AWS S3 region ap-south-2 (Hyderabad, India) for AES-256-CBC encrypted DR archives only.

Nightly encrypted backup (02:00 IST target window). Recovery objectives: RPO ≤ 24 hours; RTO ≤ 8 hours. Documented restore-test runbooks and host scripts are maintained; production restore-test logs retain evidence when scheduled integrity checks or operator drills run.

Sub-processors

We use the following sub-processors to operate the service:

  • Oracle Cloud Infrastructure (OCI): Primary compute, PostgreSQL, and MinIO object storage
  • Amazon Web Services (AWS) S3: Encrypted offsite disaster-recovery archives (ap-south-2 only)
  • Dodo Payments: Subscription checkout and billing mandates
  • Resend: Transactional email including login OTP and support notices

Incident reporting

Report suspected vulnerabilities or security incidents to security@bpsfuturetech.com. We triage confirmed incidents under our internal incident response plan and notify affected customers without undue delay after confirmation. For operational support (non-security), use support@bpsfuturetech.com.

What we do not claim

STAR Level One is a published self-assessment against the Cloud Controls Matrix / CAIQ — not a STAR Level 2 attestation certificate, SOC 2 report, or ISO certification badge. Internal policy documents are not published in full on this site. No contractual uptime percentage is published on this page.

Contact & related documents

Security desk: security@bpsfuturetech.com

Related: Privacy Policy · DPA · Terms · security.txt