India's sovereign AI inference — DPDP compliant, zero retention by default.Explore models

Trust & Security

Security at Tensor Machine

We are an infrastructure provider for regulated enterprises. Security is not a feature — it is a prerequisite. Here is how we protect your data and systems.

Data In Transit

All API traffic is encrypted with TLS 1.3. We enforce strong cipher suites and disable legacy TLS 1.0/1.1. HSTS is enabled on all public endpoints with a max-age of one year.

Data At Rest

All persistent data — account information, usage metrics, billing records — is encrypted with AES-256 using AWS KMS-managed keys. Key rotation is enforced annually.

No Inference Logging

Prompts and model responses are processed in volatile memory and are never written to persistent storage. There are no inference payload logs. Your data does not leave the inference node.

Network Isolation

All compute is deployed in isolated AWS VPCs. Inference nodes are on private subnets with no direct internet access. API traffic flows through load balancers and WAF layers before reaching compute.

Access Control

All internal access requires multi-factor authentication. Production access is granted on a least-privilege basis and reviewed quarterly. No engineer has standing access to customer data.

DDoS Protection

Cloudflare WAF and DDoS mitigation protect all public endpoints. Automatic rate limiting is enforced at both the network and application layers.

Vulnerability Management

We run automated dependency scanning on every deployment. Critical vulnerabilities are patched within 24 hours. Annual penetration testing is conducted by an independent third party.

Incident Response

We maintain a documented incident response plan with defined severity levels, escalation paths, and customer notification timelines. Post-incident reports are published for P1 incidents affecting multiple customers.

Infrastructure

All Tensor Machine systems run on AWS’s Mumbai (India) region. No customer data leaves India. Our infrastructure is designed for compliance with DPDP Act 2023 data localisation requirements, as well as sector-specific guidelines from RBI, IRDAI, and MoHFW.

We maintain separate VPCs for production, staging, and internal tooling. Cross-VPC traffic is restricted to defined service mesh routes with mutual TLS.

Compliance Documentation

Enterprise customers can request the following for vendor assessments and DPO reviews:

  • — Data Processing Agreement (DPA)
  • — Data localisation confirmation letter
  • — Security controls summary
  • — Penetration test executive summary
  • — Business continuity and DR overview

Request documentation at security@tensormachine.ai

Vulnerability Disclosure

We operate a responsible disclosure programme. If you discover a security vulnerability in Tensor Machine's systems, please report it to security@tensormachine.ai. Include a description of the issue, steps to reproduce, and the potential impact. We commit to acknowledging receipt within 24 hours and providing a resolution timeline within 5 business days for confirmed vulnerabilities.

Please do not disclose vulnerabilities publicly until we have had an opportunity to remediate and coordinate disclosure with you.

Questions about our security practices?

Contact our security team →