Last updated · 16 November 2026
01Access control
Every record is governed by row-level access rules. Operational entities are readable for situational awareness, while creation, editing and deletion are restricted by role and scope. Sensitive reference data — district risk models and the responder register — is administrator-managed.
02Audit trail
Incident lifecycle changes are recorded with the previous stage, the new stage, the acting user and a timestamp. Alert composition is attributed to the account that queued it, so post-event review can reconstruct exactly what was known and when.
03Encryption
All traffic is served over HTTPS/TLS. Credentials are handled by the platform's authentication service; Rakshak never stores plaintext passwords.
04Alert integrity
Alerts carry their source, severity, location, time and next action. Dissemination through voice, WhatsApp, SMS, email and push requires channel providers to be connected and authorised by the operating authority; until then, alerts are queued and clearly shown as not dispatched.
05Responsible disclosure
If you believe you have found a vulnerability, write to rakshak@medha.io with reproduction steps and impact. Please do not test against production data or disrupt live response activity. We acknowledge reports within two working days.
06Data residency
Operational data is hosted on cloud infrastructure configured for the operating authority's region. Contact us for the current hosting region and data processing terms before procurement.