Your members' data is a trust.
Here is how we keep it.

📋 What we collect, and why

We process member information strictly for servicing Group Term Life insurance: enrolment details and KYC (name, date of birth, contact, identity numbers), loan and cover amounts, nominee details, and — when a claim arises — the documents the insurer requires to settle it.

Purpose limitation: this data is used for enrolment, certificate issuance, renewals and claim settlement — nothing else. We do not use it for marketing to members, we do not profile members, and we never sell data to anyone.

🔒 How it is protected

• Encryption in transit — every connection to the portal runs over HTTPS/TLS.
• Tenant isolation — each bank's data is architecturally scoped to that bank. Your portal login can see your institution's members and nothing else; this is enforced in the application core on every query, not just hidden in the interface.
• Role-based access — bank users, SAS operations staff, directors (read-only oversight) and administrators each have distinct, least-privilege permissions. Claim documents are additionally ownership-checked on every download.
• Credential safety — passwords are stored only as bcrypt hashes, never in plain text. Login and password-reset endpoints are rate-limited against brute-force attempts.
• Upload discipline — document uploads are restricted by file type and size, and stored outside the web-served directory.
• Infrastructure — application code, configuration and the database live above the web root and are not directly reachable from the internet; server access is restricted to authorised SAS personnel over authenticated SSH.

🤝 Who we share with

Member data is shared only with the insurance broker and insurer appointed for your policy (for example Go Digit Life via Riskcovry, Credit Access Life via SIP Fund, or Aviva Life via Policy Grace), and only to the extent required to enrol members, issue certificates and settle claims. No other third party receives member data, except where the law requires it.

⚖️ Legal alignment — DPDP Act, 2023

Our handling of personal data is aligned with the principles of India's Digital Personal Data Protection Act, 2023: processing on a lawful basis for a specified purpose, data minimisation, accuracy, storage limitation, and reasonable security safeguards. Members' data is collected through their enrolment and consent forms as part of the insurance proposal.

💾 Retention, backups & deletion

Records are retained for the life of the policy relationship and any period required by insurance and tax law, after which they are removed. Deleted records first enter a controlled recycle stage before permanent removal, protecting against accidental loss. The database is backed up daily as consistent, compressed snapshots stored outside the web-served area.

🚨 If something goes wrong

In the event of any incident affecting the confidentiality of partner data, we commit to promptly informing the affected institutions, containing and remediating the issue, and cooperating fully with the bank's own reporting obligations. Concerns can be raised any time through your Relationship Manager or Cluster Head, or in writing to SAS InsureTech Solutions Pvt. Ltd., Belagavi, Karnataka.