> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/support-and-reference/security-and-compliance.md).

# Security and Compliance

## Certifications and accreditations

* Licensed Certifying Authority under CCA, India; empanelled eSign Service Provider
* WebTrust for CAs audited
* ISO/IEC 27001 certified operations
* Qualified / accredited trust service provider in India, UAE and Kenya
* emSign roots in Adobe Approved Trust List (AATL) and Microsoft Trusted Root Program

## Key controls

| Area                     | Control                                                                                                         |
| ------------------------ | --------------------------------------------------------------------------------------------------------------- |
| Key generation & storage | FIPS 140-3 Level 3 HSMs; ESP signing HSM separate from CA issuing HSM; no cleartext key export                  |
| One-time keys            | Destroyed immediately after signing (eSign v2/v3)                                                               |
| Long-term keys           | Wrapped backups; deleted within 15 minutes of revocation (Remote Key Storage)                                   |
| Signer authentication    | Aadhaar factors (v2); PIN + second factor (v3); AuthPIN verified in HSM + application auth (Remote Key Storage) |
| Message integrity        | ASP request XML and ESP response XML are digitally signed (XML-DSig)                                            |
| Transport                | TLS 1.2+ for all endpoints                                                                                      |
| Privacy                  | Only document hashes are received; ASPs never receive Aadhaar or eKYC data                                      |
| Consent                  | Explicit electronic consent captured and logged                                                                 |
| Audit                    | Tamper-evident logs, signed Form C, monthly IS audit sampling, annual CA audit                                  |
| Retention                | Evidence retained for at least 7 years                                                                          |
| Availability             | DC/DR in India, HSM clustering, capacity ≥ 1,000 eSign transactions/minute                                      |
| Data residency           | All eSign data processed and stored in India                                                                    |