KiAlt
·Data Trust & SecurityEncrypted at rest
All client data stored with AES-256 block-level encryption
Encrypted in transit
TLS 1.3 on every API call — no plain-text transmission ever
Never sold or shared
We have no data-resale model. Zero. Contractually binding.
Isolated per MFD
Tenant-level data isolation — your data never touches another firm's
Sell your clients' data to any third party — ever
Use your client portfolio data to train AI models
Share client identifiable information with AMCs, BSE, or any market participant
Use your data to cross-sell to your clients directly
Access your client data without an explicit, logged service request
Store raw CAMS/CAS files beyond the processing window
Encrypt all client data at-rest (AES-256) and in-transit (TLS 1.3)
Keep each MFD's data in isolated, access-controlled tenants
Give you full ability to delete your data — including on request
Log all internal access to production data with time-stamped audit trails
Use anonymised, aggregated benchmarks only — never linked to a client
Align with India's DPDP Act (Digital Personal Data Protection Act) framework
Six Technical Pillars
Multi-Tenant Isolation
Each MFD firm is provisioned in its own isolated data partition. Row-level security policies ensure that no query from Firm A can ever surface data belonging to Firm B — even within the same database cluster.
Encryption at Every Layer
All client PII fields (names, PANs, phone numbers) are encrypted before being written to the database. Even if a database dump were somehow obtained, the data would be unreadable without the encryption keys — which are stored separately.
Zero Trust API Access
All APIs are authenticated using short-lived JWT tokens. No long-lived secrets are used. Every API call is validated against the requesting user's role and the MFD tenant scope before any data is returned.
Immutable Audit Logs
Every read and write operation on sensitive data generates a time-stamped, tamper-proof audit log entry. This includes internal KiAlt team access — we see only what we log, and every log is retained and attributable.
Right to Erasure
When you off-board or request data deletion, KiAlt runs a verified purge across all storage layers — primary DB, backups, and any derived caches. You receive a deletion confirmation. No shadow copies.
Secure File Processing
Portfolio files (CAS Excel, CAMS PDFs) are processed in ephemeral compute environments. The raw file is parsed, structured, and immediately discarded — never written to long-term storage in its original form.
The Data Flow: Six Steps to Trust
Upload Initiated
The file is selected on your device. It's transmitted over a TLS 1.3 encrypted HTTPS connection to KiAlt's servers. No intermediary can intercept or read it in transit.
Ephemeral Parsing
The file is loaded into a short-lived compute session. Relevant data (folio numbers, scheme names, NAVs, units) is extracted and structured. The original raw file is never persisted to disk.
PII Encryption
Personally identifiable fields — client name, PAN, mobile number — are encrypted using AES-256 with your tenant-specific encryption key before a single row is written to the database.
Tenant-Scoped Storage
Structured data is stored under your MFD's isolated partition. Row-level policies prevent cross-tenant queries at the database engine level — this is enforced in code, not just in access rules.
Usage & Analytics
If KiAlt ever uses portfolio data to improve benchmarks or scoring, it does so only on anonymised, aggregated signals. No client identity, no firm identity. Individual portfolios are never used as training data.
Deletion on Request
When you delete a client record or off-board entirely, a verified cascade purge runs across all storage layers. You receive written confirmation of deletion.