This is the notice required by section 5 of the Digital Personal Data Protection Act 2023. SecureXcel Pvt Ltd is the Data Fiduciary for the personal data described here.
| Account details | Your name, email address and company, so you can sign in and so a report can be attributed to you. Lawful basis: the consent you give when creating an account. |
|---|---|
| Enquiries | Your name, email, company, phone if given, and your message, so we can reply. Lawful basis: your consent when you submit the form. |
| Review results | A finding count, a score and the device vendor, so your dashboard can show your history. No configuration content is kept. |
| Server logs | IP address, request path, status and timing, to operate and secure the service. Query strings and referrers are deliberately not logged. Lawful basis: legitimate use under section 7. |
Firewall configurations, cloud credentials and the contents of reports are never written to disk or to a database. A configuration is parsed in memory and discarded when the response is sent. Cloud credentials are used for a single request and dropped. This is not a policy choice we could quietly reverse — the offline tool exists precisely so that configurations need never reach us at all.
| Enquiries | 24 months, then erased automatically. |
|---|---|
| Sign-in sessions | Until they expire, then erased. |
| Account and review history | Until you delete your account. |
Erasure runs on a daily timer rather than when someone remembers.
Stored data is encrypted at rest with AES-256 using Oracle Cloud Infrastructure block volume encryption, with Oracle-managed keys. Traffic between you and the service is encrypted with TLS 1.2 or 1.3. Passwords are stored as PBKDF2-HMAC-SHA256 hashes with 600,000 iterations and a per-user salt, so we cannot read them. The full list of safeguards is here.
Nobody. We do not sell personal data, we do not share it with advertisers, and we run no analytics or tracking scripts — the site loads nothing from a third party, which you can confirm from its Content-Security-Policy. We use a cloud provider to host the service and a mail provider to answer you; both process data on our instructions, in India.
| Access — s.11 | Download everything we hold about you. |
|---|---|
| Correction — s.12 | Email us; corrected within one working day. |
| Erasure — s.12(3) | Delete your account from your dashboard. |
| Withdraw consent — s.6(4) | Deleting your account withdraws it. Nothing further is processed. |
| Nominate — s.14 | Email us to nominate someone to exercise your rights if you cannot. |
| Grievance — s.13 | Email connect@securexcel.com marked "DPDP grievance". Acknowledged within one working day. If you remain dissatisfied, you may complain to the Data Protection Board of India. |
This service is for businesses and is not directed at anyone under 18. We do not knowingly collect a child's personal data. If you believe we have, tell us and we will erase it.
If personal data we hold is breached, we will notify the Data Protection Board of India and every affected person, as section 8(6) requires. We will tell you what happened and what to do about it, not merely that something occurred.
Questions about this notice, or about any of the rights above, go to connect@securexcel.com. The technical safeguards are described here.
Last updated 1 November 2026. If this notice changes materially we will say so on this page rather than change it silently.