Trust centre
This page says what is built today and what is still planned. ConductLens is early: several protections below are designed but not live yet, and each one is marked so you do not have to guess.
Built works today and is covered by automated tests. In build partly done. Planned designed, not built.
How we handle what we test
On a public site we navigate, scroll and take screenshots. We never type, tick a box, sign in or submit a form, we respect robots.txt, and we pace ourselves to one action a second. Tests check that forbidden actions are refused.
Authorised audits will use generated identities in your test environment. We will never need real customer data.
Free-text fields are masked before a screenshot is taken, and PAN, Aadhaar, phone, email and account numbers are masked in captured text. An image-based text pass over screenshots is not built yet, so we do not accept real sites for snapshots until it is.
Credentials will be fetched only for the run that needs them and never written to logs.
Evidence and review
Each screenshot, page text and element map gets a SHA-256 hash at capture.
Each run's manifest is chained to the previous one. A command re-checks every hash and the chain without contacting us, and fails if a single byte has changed.
Report manifests will be signed with a key held in a managed key service, with the public keys published.
Detectors only propose candidates. A report is refused while any candidate is unreviewed, and a rejection needs a written reason.
The checks that exist now do not send anything to an AI model. Any model we add will see only masked material, and will never decide a finding on its own.
Where data lives
The audit platform is designed to run in AWS Mumbai (ap-south-1) with disaster recovery in Hyderabad (ap-south-2). It is not live yet.
Row-level security in the database and a separate encryption key per customer.
Evidence will be stored with write-once retention, encrypted with your key.
For enterprise customers: the tester runs in your environment and makes outbound connections only.
This website
Pages are served as plain files. Fonts are hosted on the same server. We do not set cookies, so there is no cookie banner.
Your name, work email, institution, what you want, an optional journey address, and a record of your consent. See the privacy notice.
Who else handles data for us
Holds the enquiries you send through this website, and sends us the notification email.
Hosts our business mailbox, so it holds the emails we exchange with you, including the notification of an enquiry.
Will host the audit platform and evidence in India.
Not used by any check today. If we add one, the provider and region will be agreed with each customer and listed here.
Independent assurance
We hold no security certification today. We plan an independent penetration test by a CERT-In empanelled auditor before the first bank goes live, and ISO 27001 and SOC 2 readiness work during 2027. When any of these is complete we will say so here, with the date and the scope.
Report a security problem
See our responsible disclosure page. For privacy requests, see the privacy notice and the grievance officer.
Last updated 15 October 2026.