Sample Trust Center — this is how your page will look.
Northwind Payments
Security, privacy and compliance at a glance — for the teams evaluating us.
Hosted in India — data residency assured- Data in India
- 100%
- Mumbai + Hyderabad
- Certifications
- 5
- ISO, SOC 2, PCI…
- Last audit
- Aug 2026
- SOC 2 Type II
- Uptime
- 99.98%
- Trailing 12 months
Regulatory Alignment
Guidelines on Payment Aggregators
RBI
Authorised — compliant
Reviewed annually by an independent assessor.
Digital Personal Data Protection Act, 2023
MeitY
Data Fiduciary readiness assessed
Named DPO and Grievance Officer published below.
Directions on Cyber Incident Reporting
CERT-In
Compliant — 6 hour reporting
Logs retained 180 days within India.
Certifications
ISO/IEC 27001:2022
Certified since 2023
SOC 2 Type II
Security, Availability
PCI DSS v4.0
Payments scope
ISO/IEC 27701
Privacy extension
NIST CSF 2.0
Control environment aligned
Security Controls
Data protection
- AES-256 encryption at rest
- TLS 1.3 in transit
- Field-level tokenisation of card data
Access control
- Mandatory MFA for all staff
- Quarterly access recertification
- Just-in-time production access
Monitoring
- 24×7 SOC with defined escalation
- Immutable audit logging
- Annual third-party VAPT
Continuity
- RTO 4 hours / RPO 15 minutes
- DR region in Hyderabad
- Twice-yearly failover tests
Documents
- ISO 27001 Certificate
- Information Security Policy
- SOC 2 Type II Report
- VAPT Summary — Q2 2026
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting | Mumbai, India |
| Cloudflare | Edge network and WAF | India PoPs |
| Freshworks | Support ticketing | Chennai, India |
Frequently Asked Questions
Where is customer data stored?
Exclusively in India — Mumbai primary, Hyderabad for disaster recovery. Nothing is replicated outside Indian territory.
How quickly are incidents reported?
To CERT-In within six hours of confirmation, and to affected customers within 72 hours.
Can we audit you?
Enterprise customers may run an annual audit with 30 days notice. Most reviewers find the SOC 2 report answers the same questions.
Contact
Data Protection Officer
Priya Venkatesan
dpo@northwindpay.in
Grievance Officer
Arun Mehta
grievance@northwindpay.in
Like how this looks?
Yours can be live this week — on your own domain, in your brand.