Trust
DPDP Act 2023
Fonada describes its security practices as aligned with India’s Digital Personal Data Protection Act, 2023. That is not a government certificate, and this page does not claim one.
The Digital Personal Data Protection Act, 2023 is India’s law on how organizations collect and use digital personal data. Fonada’s public wording is “aligned,” including on the security policy and on healthcare pages. It is not worded as a certification.
The controls named alongside that statement are TLS 1.3 in transit, encryption at rest, role-based access, single sign-on, multi-factor authentication, audit logs, and retention and deletion that can be configured. Enterprise customers can request the written security documentation.
How Fonada handles personal data is in the privacy policy. SOC 2 Type II and ISO 27001 are separate reviews and do not, by themselves, mean a DPDP registration or a government seal.
Questions
Is Fonada DPDP certified?
No. Fonada says its practices are aligned with the DPDP Act 2023. The site does not describe a DPDP certificate.
What does alignment mean on this site?
The published controls are encryption in transit and at rest, role-based access, audit logs, configurable retention and deletion, and compliance documentation for enterprise customers on request. The privacy policy covers how personal data is handled.
Does SOC 2 or ISO 27001 replace the DPDP Act?
No. SOC 2 Type II and ISO 27001 are separate security reviews. DPDP alignment is the statement about India's data protection law. Fonada publishes all three, and they are not substitutes for each other.
Where is the privacy policy?
The privacy policy is at /legal/privacy-policy/. Vulnerability reports go to security@fonada.com.