We hold documents that prove who you are. We treat them that way.

Encryption

• In transit. All traffic between the app or website and our servers uses TLS 1.2 or higher. The website is served over HTTPS only, with HTTP redirected and HSTS enabled. Modern cipher suites only.
• At rest. The database and uploaded document storage sit on encrypted volumes.
• Secrets. API keys and credentials live in environment configuration, never in source control, and are rotated when staff or providers change.
• Sensitive fields. Aadhaar numbers are masked at the point of capture and the raw number is scrubbed before storage - it never reaches the database, the admin interface or a log file.

Authentication and sessions

• No passwords. Accounts are secured by one-time codes sent to your registered phone number, so there is no password to guess, reuse or leak.
• OTPs are hashed before storage, expire quickly, are single-use, and are rate-limited per number with an attempt counter - repeated failures lock the number temporarily.
• Sessions use short-lived access tokens with longer-lived refresh tokens. Refresh tokens are stored as hashes only, bound to a device identifier, and can be revoked individually.
• Revocation. Logging out revokes the token immediately. We revoke sessions automatically when we detect something suspicious, and can revoke every session on an account when asked.
• Admin access to the review console is separately authenticated, restricted to the small verification review team, and fully audited.

Infrastructure

• Location. Servers, database and document storage are hosted in India with established cloud providers. We do not routinely move personal data outside India.
• Network isolation. The database is not exposed to the public internet. Only the application layer can reach it, over a private network.
• The website is served as static files through a global CDN with DDoS protection, and carries no database connection of its own.
• Separation. Development, staging and production are separate environments. Production data is never copied into development.
• Patching. Operating systems, runtimes and dependencies are kept current, and we monitor advisories for the packages we depend on.
• Rate limiting is applied to OTP requests, verification calls, public forms and other abusable endpoints.

Verification documents

These deserve their own section because they are the most sensitive thing we hold.

• Uploaded documents are stored in restricted storage, not on any public URL.
• They are viewable only through the authenticated admin console, by the small team who run verification review.
• Every access is logged - who looked, at what, and when.
• An audit record of every verification call made about a driver is kept, so any decision about an account can be explained to that driver and reviewed independently.
• Documents are never shared with other users, never sold, and never used for anything other than verification, fraud prevention and legal obligations.
• Retention periods are published in the Privacy Policy.

Backups and continuity

• Encrypted database backups are taken on a regular schedule and stored separately from the live system.
• Restores are tested - a backup nobody has restored is a rumour, not a backup.
• Backups follow the same retention and deletion rules as live data, so a deletion request is not quietly undone by a restore.
• Uploaded documents are stored redundantly.

Privacy built into the product

Some of the strongest protections are product decisions rather than infrastructure:

• Customer details are hidden by default and released to exactly one driver, only when the poster presses share.
• Location is collected only while you are on duty, only as a last known position, and is never shown to other users - they see a distance, not a place.
• Exact coordinates never leave our servers; distances are computed in-house rather than sent to a mapping provider.
• No advertising identifiers, no ad SDKs, no cross-site tracking - in the app or on this website.
• We collect the minimum needed to verify you and run the exchange. There is no field on this platform that exists "just in case".

Incident response

If a security incident affects personal data, we will:

1. Contain it - revoke affected credentials and sessions, and close the route in.
2. Investigate - establish what was accessed, by whom, and for how long.
3. Notify - inform affected users and the relevant authorities within the timelines required by Indian law, including the DPDP Act and CERT-In directions.
4. Explain - publish what happened, what we did, and what we changed so it does not happen again. We would rather be uncomfortable than vague.

Service disruptions, security-related or not, are posted at dutiess.com/status.

Responsible disclosure

If you find a vulnerability, please tell us before you tell anyone else. We will not take legal action against researchers who act in good faith.

• Email hello@dutiess.com with "Security" in the subject line, or use the report form and pick "Security".
• Include the steps to reproduce, the impact, and anything needed to verify it.
• Please do test only against your own account, and stop as soon as you have proved the issue.
• Please do not access, modify or delete other users' data, run denial-of-service or automated scanning that degrades service, use social engineering against our staff or drivers, or publicly disclose before we have fixed it.
• We acknowledge within 72 hours, keep you updated, and will credit you publicly if you would like that.

We do not currently run a paid bug bounty - we are a small pre-launch team - but we take reports seriously and respond to every one.

Compliance and governance

• Digital Personal Data Protection Act, 2023 - we operate as a Data Fiduciary, with consent-based processing, published retention periods, and a Grievance Officer named in the Privacy Policy.
• Information Technology Act, 2000 and the rules made under it, including reasonable security practices for sensitive personal data.
• CERT-In directions on incident reporting and log retention.
• Motor Vehicles Act and state transport rules - our commercial-permit gate exists so that duties are performed by vehicles licensed to carry passengers.

We are pre-launch and hold no third-party security certification yet. We would rather say that plainly than imply an audit we have not had. As we grow, formal assessments are on the roadmap.

What you can do

• Never share your OTP. Dutiess will never ask for it - not by call, not by WhatsApp, not by anyone claiming to be support.
• Never pay anyone to get verified. Verification is free and automatic. Anyone asking for money is a fraudster - report them.
• Keep a screen lock on your phone, and log out on any device you no longer use.
• Install only from official sources. An APK from a WhatsApp group is not our app.
• Report anything odd - a profile that does not match the person, a message that feels like phishing, a request for documents.

---

Related: Privacy Policy · Verification Policy · System status · Report abuse