Security & Compliance

Security you can check for yourself

Data is encrypted on your own machine before it moves, backups can be locked so nothing can delete them inside the period you set, and every action is written to a trail you can hand to a reviewer.

Scroll to see the whole screen

Controls

What protects your backups

Included for every machine you protect. There is no higher tier that unlocks any of it.

Encrypted on your machine (AES-256)

Data is encrypted on your machine before it moves and stays encrypted in transit and at rest. You choose who holds the encryption password: we can manage it for you, or in zero-knowledge mode you hold it alone and we cannot read your backups.

Locked backups nobody can delete

Lock backup copies for a retention period you define. During that period, backups cannot be modified, overwritten or deleted by ransomware, by someone holding stolen credentials, or by us. That we cannot delete it either is what makes this a control rather than a promise.

Your data stays where you put it

Buy storage from us and your backups are kept in India, in a bucket set up for you alone. Bring your own and you pick the provider and the region, or keep a copy on a local drive. We never move your data anywhere you did not choose.

Covers the backup side of DPDP

Each client's data is kept separate, copies are kept for the period you set, and the audit trail exports as evidence. Those are the backup parts of your DPDP obligations. The rest is about how you run your own systems.

Multi-factor sign-in

Authenticator app MFA with emergency recovery codes, a limit on repeated sign-in attempts, and a password reset that signs the account out everywhere at once.

An audit trail you can export

All backup jobs, restores, logins and credential changes are recorded, and you can export the record for a compliance review or a security questionnaire.

Under the DPDP Act

Who is responsible for what

The Act separates the business that decides what happens to personal data from the one that carries out its instructions. For your backups, that is you and us.

You

Data Fiduciary

You decide what is backed up, how often, how long it is kept, and where it is stored.

Serverstock

Data Processor

We run backups on your instructions. File contents never pass through our servers, and if you bring your own storage they never rest on storage we provide either.

Team sign-in with Microsoft 365 and MFA

SSO & MFA

Scroll to see the whole screen

Our standard Data Processing Agreement (DPA) defines complete contractual terms. We can review custom enterprise procurement requirements during onboarding.

Security & Vendor Due Diligence

Frequently asked technical questions

Direct, plain-language answers for your infosec and compliance reviewers.

Who can read our backups?

You decide. Files are encrypted on your own machine before they leave it, and they never pass through our servers. With zero-knowledge encryption you alone hold the password, so nobody else can read your backups, including us. If you would rather not risk losing the password, we can manage it for you instead: it is stored encrypted, used only to run your backups and restores, and kept so we can help you recover if you lose yours.

How does Satkosh help against ransomware?

By making sure ransomware cannot destroy the copy you recover from. Once a backup is locked, no user, compromised credential or system process can delete or overwrite it until the retention window expires, and you restore from the last clean copy. Satkosh does not scan for or block ransomware on your machines; that is the job of your antivirus, and Satkosh works alongside it.

Where does our backup data physically reside?

Wherever you choose. Storage bought from Satkosh is kept in India. Your own bucket can be with AWS S3, Wasabi or another S3-compatible provider, in whichever region you pick, including an Indian one. You can also write to a local drive. In every case the data goes straight from the machine to that storage and never passes through our servers.

Do you provide a signed Data Processing Agreement (DPA)?

Yes. We offer a standard Data Processing Agreement aligned with the Digital Personal Data Protection (DPDP) Act to support your vendor compliance requirements.

How are agent updates managed and verified?

Updates are cryptographically signed and install only when an administrator triggers them from the console. Endpoints verify the digital signature before applying any update.

Do you hold SOC 2 or ISO 27001 certifications?

Not yet. Until we do, we answer your security questionnaire in full, walk your IT team through how Satkosh is built on a call, and sign a Data Processing Agreement aligned with the DPDP Act.

Book a demo

Need security documentation for procurement?

We can walk your IT and compliance team through our technical architecture, provide questionnaire responses, and conduct a live restore verification.

No spam, just a reply from our team. Managed backup by Serverstock. Made in India.