Trust Centre
Built for the Regulatory Standards AIFs Demand
Navigate AIF is designed ground-up for SEBI-regulated Alternative Investment Funds. Our infrastructure, security controls, and compliance architecture meet the standards of India's most stringent fund managers.
Certificate Number 26992
ISO 27001
View certificate
Security
Enterprise-Grade Security Infrastructure
End-to-End Encryption
All data in transit is protected using TLS 1.2/1.3. Sensitive data at rest is encrypted using AES-256. Accreditation API integrations use AES-256-GCM encryption with platform-specific key management.
Role-Based Access & Audit Logs
Access to all user data is restricted on a strict need-to-know basis. Every access event is logged and monitored. Navigate AIF supports multi-zone org structures for enterprise clients, with granular permission management across fund teams.
Secure Cloud Infrastructure
Navigate AIF is hosted on enterprise-grade cloud infrastructure with firewalls, intrusion detection systems, and automated security patching. Customer data is logically segregated across organisations. No cross-tenant data access is possible by design.
Compliance
Aligned With SEBI's Regulatory Framework
Navigate AIF is purpose-built for the SEBI AIF regulatory ecosystem. Our platform architecture maps directly to SEBI's compliance requirements — from CSCRF (Cyber Security and Cyber Resilience Framework) to the Digital Accessibility Circular (2024), DPDP Act readiness, and AIF Regulations, 2012.
We are not a generic SaaS platform retrofitted for finance — we are an AIF-native compliance platform.
Controls
Security Controls
A summary of the technical and organisational controls Navigate AIF has implemented.
Data Segregation
Each fund/organisation's data is logically isolated at the infrastructure level. No cross-tenant data access is possible by design. Multi-zone org structures support enterprise-level access boundaries.
Audit Logging
All user activity — login events, document access, regulatory submissions, KYC verifications — is logged with timestamps, IP metadata, and user identity.
Data Retention & Deletion
Personal data is deleted within 90 days of account closure. KYC and Google Calendar sync data is purged within 30 days of access revocation. Aggregate, anonymised data may be retained for analytics.
Vulnerability Management
Regular security assessments and vulnerability scans are conducted across the platform. Dependencies are monitored for known CVEs and patched on a defined SLA.
Third-Party Risk
Third-party providers are assessed for security posture before onboarding and are bound by data processing agreements. Navigate AIF does not sell or share personally identifiable data with any third party for commercial purposes.
People & Process
Security Starts With Our Team
Technical controls only go so far. Navigate AIF's organisational security practices ensure that insider risk, access misuse, and process failures are minimised.
Background Verification
All team members with access to production systems or client data undergo background verification prior to onboarding. Access is provisioned only after verification is complete.
Security Awareness Training
Engineers and operations staff complete mandatory security awareness training covering phishing, data handling, access hygiene, and incident reporting. Training is refreshed periodically.
Access Provisioning & Deprovisioning
Production system access follows a formal provisioning workflow — access is granted only when required and revoked immediately upon role change or departure. All access grants are documented and reviewed.
Minimum Necessary Access
No team member holds broad standing access to client data. Access to production environments requires explicit authorisation, is logged in full, and is reviewed on a periodic basis.
Penetration Testing
Independent Security Testing
Periodic Penetration Testing
Navigate AIF undergoes periodic penetration testing by independent security professionals. These assessments cover our API endpoints, authentication mechanisms, data access controls, and web application surface area.
Testing follows OWASP Top 10 and CREST-aligned methodologies. Critical findings are remediated before public disclosure, with a defined patching SLA.
Test Scope
Penetration test reports are available to enterprise clients and fund managers upon execution of an NDA. Contact us at support@navigateaif.com.
Incident Response
Our Commitment When Things Go Wrong
Navigate AIF maintains a documented incident response process. Below are our commitments to clients in the event of a security incident.
Detection & Notification
Affected clients are notified within the timeframes required by applicable law upon confirmation of a security incident involving their data. We will not delay notification pending investigation completion.
Containment & Investigation
Our team immediately isolates the affected systems, preserves forensic evidence, and begins root cause analysis. External security experts are engaged where required.
Post-Incident Report
Enterprise clients receive a written post-incident report covering root cause, data affected, timeline of events, and remediation steps taken — within a reasonable timeframe after resolution.
Navigate AIF will make reasonable efforts to notify users of legal disclosures unless prohibited by law or court order.
Data Practices
How We Handle Your Data
What We Collect
Navigate AIF collects End User activity logs, device metadata, and data from regulatory integrations strictly for platform operation. We do not collect data beyond what is necessary to provide compliance and onboarding services.
We Do Not Sell Your Data
Navigate AIF does not sell, transfer, or share personally identifiable information with any third party for commercial purposes. Google user data accessed via the Compliance Calendar is never shared externally and is used solely for compliance tracking functionality, in accordance with Google's Limited Use Policy.
User Rights & Control
End Users may revoke Google Calendar access at any time via Google Account settings. Personal data deletion requests are honoured within 30 days. Customers may request full organisational data deletion through their account administrator.
Responsible Disclosure
Found a Vulnerability? We Want to Know.
Navigate AIF takes security reports from the community seriously. If you have identified a potential security issue in our platform, please reach out — we are committed to working with you responsibly.
Policy Commitments
- We accept vulnerability reports at support@navigateaif.com
- We will acknowledge receipt within 48 hours
- We will provide a resolution timeline within 7 business days of triage
- We will not pursue legal action against researchers acting in good faith
- We request that findings not be publicly disclosed until we have had a reasonable opportunity to remediate
Report the vulnerability with steps to reproduce, potential impact, and supporting evidence to support@navigateaif.com.
We will acknowledge your report within 48 hours and assign it for triage.
Our security team assesses severity, prioritises remediation, and keeps you informed of progress. Critical issues are patched on an expedited SLA.
Once resolved, we notify you of the fix and recognise good-faith reporters in our disclosure acknowledgements where consent is given.
Navigate AIF's responsible disclosure programme applies to our web platform, API endpoints, and mobile interfaces. It does not cover third-party services or infrastructure outside our direct control.
FAQ
Frequently Asked Questions
Questions About Our Security Practices?
Our team is happy to walk you through our controls, share documentation, or answer a security questionnaire for your fund's due diligence process.
