So here is where the data sits, who can reach it, and how you get all of it back — in language the committee can repeat at the AGM.
Mumbai primary · Hyderabad replica. Nothing — not a backup, not a log, not a gate photograph — leaves the country.
Indian regions only — primary in Mumbai, replica in Hyderabad. No society data, backup or log leaves India. That includes residents' phone numbers, gate photographs and vehicle records.
TLS 1.3 in transit, AES-256 at rest, including database backups and gate photographs. Attachments are served through short-lived signed links, never public URLs. The ciphers, and row-level security →
Role-based, and scoped to the society: a guard sees today's gate, not the ledger. A resident sees their flat, not their neighbour's arrears. The auditor sees books, not resident phone numbers. External roles are granted by the committee and revocable in one tap. How the committee grants and revokes →
Every financial write records who, when, from where and what changed — including the value before the change. Logs are append-only and outlive the person who made the entry.
A closed month cannot be edited by anyone, including us. Corrections post as dated adjustment entries so the trail stays continuous.
Continuous replication with 30 days of point-in-time recovery, tested by restore drill each quarter. RPO 5 min · RTO 4 hrs
Money moves through RBI-regulated payment partners. Zwangu never stores card numbers or bank credentials — only the reference and status of each transaction, attached to its receipt.
Your society is the data fiduciary; Zwangu is the processor, under a signed agreement. Consent notices for residents, correction and erasure requests, and breach notification within statutory timelines are built in. What the Act asks of the committee →
Visitor photos are kept for the period your committee sets — 90 days by default — then deleted automatically. Guards cannot export or download them at all.
Full export — members, ledger, vouchers, attachments, gate logs — available from day one, in XLSX, PDF and Tally-readable formats. On termination we delete your data within 30 days and confirm it in writing.
