Your data, handled the way you'd want it handled.
Trakovia touches your website, your marketing and your inbox. Here is exactly how we protect that, security engineering with our partner Dravincon, and privacy under India's DPDP Act.
Encryption
All traffic uses TLS. API keys, mailbox passwords and Search Console tokens are encrypted at rest with AES-256. Passwords are hashed with bcrypt.
Safe crawling
Our crawler only fetches public websites, respects robots.txt, never follows links into private networks, and identifies itself as TrakoviaBot.
Least access
Admin access is limited and every sign-in attempt is logged and kept for a year, as the DPDP Rules require.
Security testing
Dravincon, a vulnerability assessment and penetration testing firm, tests the platform. Enterprise customers can request the latest summary.
Email safety
Outreach goes from your own mailbox with daily caps, a postal address, one-click unsubscribe and a global do-not-contact list. Auto-replies follow RFC 3834 loop protection.
Sign-in protection
Two-factor codes from an authenticator app and passkeys (fingerprint or face) for customers. Two-factor is required for every Trakovia admin. Repeated wrong passwords lock the account for 15 minutes.
Social accounts
We never see your social passwords: each network gives us an access token, which is encrypted. Disconnecting deletes it immediately.
Backups
Encrypted nightly database backups, kept for 14 days.
DPDP Act 2023, what's built in
| Requirement | How Trakovia does it |
|---|---|
| Clear notice and consent (s.5, s.6) | Plain-language notice; separate, unticked boxes for service and marketing; every consent logged with version, time and source. |
| Withdraw as easily as given | One switch in the Privacy Centre; cookie settings link on every page. |
| Access, correction, erasure (s.11 to 12) | Self-serve JSON export, profile editing, account erasure with tax records retained only as required. |
| Nomination (s.14) | Customers can name a nominee in the Privacy Centre. |
| Grievance redressal in 90 days | Public request form, tracked deadlines, automatic reminders to our Grievance Officer. |
| Storage limitation | Nightly retention job: leads 12 months, inbox copies per your setting, logs 1 year, inactive accounts erased after 3 years with 48-hour notice. |
| Breach reporting in 72 hours | Internal breach register with Board-report deadlines. |
Questions or a security report? Write to security@trakovia.com.