Trust Centre
How Being Vakil Associates protects client information. Everything on this page is a statement of current fact as of 28 October 2026. Where something is still in progress, we say so.
1. Overview
Being Vakil Associates is a firm of advocates with offices in Mumbai, Pune, New Delhi and Noida.
- Contact: advocate@beingvakil.in, +91 93262 47985
- Technology: built and run for the Firm by iuraverse Technologies Private Limited, under a data processing agreement (being finalised).
- Last updated: 28 October 2026
Bar Council of India disclaimer. Under the rules of the Bar Council of India, advocates are not permitted to solicit work or advertise. This page is published only to inform clients and their compliance teams about how the Firm handles information. It is not an advertisement, solicitation or invitation, does not constitute legal advice and does not create an advocate-client relationship.
2. Client confidentiality and privilege
- Our advocates are bound by the professional duty of confidentiality under the Bar Council of India Rules.
- Communications between advocates and clients are protected under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023.
- We run a conflict check before taking on every engagement.
- Every engagement is on written terms.
3. Where data is hosted
- Client data is hosted primarily in India. The main database is in Mumbai (Supabase, on AWS region ap-south-1). Notice Desk and the due diligence portal run on Google Cloud in Mumbai.
- Daily database backups are kept for 7 days in Mumbai.
- Application backups: move to Mumbai in progress. Since 28 October 2026, nightly encrypted application backups are written to Google Cloud in Mumbai and, in parallel, to a Cloudflare storage service outside India. From 4 November 2026, new backups go to Mumbai only. The older copies outside India will be deleted on or after 11 November 2026, after the Firm approves the deletion. We will update this page when that is done.
- Website traffic passes through Cloudflare's global network. Services outside India are named in the service provider list.
4. Security measures in place
Only measures we have checked are listed here.
- HTTPS (encrypted connections) on all our websites and portals.
- Security headers on all Being Vakil law firm websites (beingvakil.in, www.beingvakil.in, notice.beingvakil.in, duediligence.beingvakil.in, verify.beingvakil.in and trust.beingvakil.in): HSTS, content security policy, frame protection, MIME-type sniffing protection, referrer policy and permissions policy.
- One-time password (OTP) sign-in on our client and internal portals.
- Role-based access: people see only what their role requires.
- Nightly backups encrypted with AES-256-GCM before they are stored.
- Activity logs on our platforms.
- Blockchain timestamp seal on our documents, which anyone can check:
- Title search reports, due diligence reports, trademark reports and our other reports: verify.beingvakil.in
- Legal notices: notice.beingvakil.in
5. Our infrastructure providers' certifications
Our main infrastructure providers hold their own independent certifications. These belong to the providers, not to Being Vakil.
| Provider | Their certifications (per the provider's published compliance information) |
|---|---|
| Google Cloud | ISO/IEC 27001, SOC 2 |
| Cloudflare | ISO/IEC 27001, SOC 2 |
| Supabase | ISO/IEC 27001, SOC 2 |
Being Vakil's own ISO/IEC 27001 work is under process. See the roadmap.
6. Privacy and the DPDP Act
- Privacy policy: beingvakil.in/privacy-policy
- We use personal data to deliver legal services, meet our legal and professional duties, and run our portals securely. We do not sell or share client data for marketing.
- To withdraw consent, or to ask for access, correction or deletion of your data, write to advocate@beingvakil.in.
- Grievance Officer: Adv. Shweta Sudhir, advocate@beingvakil.in, +91 93262 47985.
- We acknowledge grievances within 48 hours and resolve them within a period not exceeding 90 days. If you are not satisfied, you may approach the Data Protection Board of India.
- We are aligning our practices with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ahead of their main obligations, which apply from around May 2027.
7. Breach response
- Reportable cyber security incidents are reported to CERT-In within 6 hours of our becoming aware of them, as the CERT-In Directions require.
- Personal data breaches are reported to the Data Protection Board of India and to affected clients and individuals without delay, with a detailed report to the Board within 72 hours, as the DPDP Rules require.
8. Service provider list
| Provider | Purpose | Region |
|---|---|---|
| Supabase (on AWS) | Main database and its daily backups; this trust centre's records and documents | India (Mumbai) |
| Google Cloud | Notice Desk, due diligence portal, encrypted application backups | India (Mumbai) |
| Cloudflare | Website delivery and network protection; older encrypted backup copies until deletion (on or after 11 November 2026) | Global network |
| Resend | Sending this trust centre's emails (sign-in codes and access links) | Japan (Tokyo) |
Messaging, OTP and document processing providers are being confirmed, with their regions, and will be added here. The full list is available on request.
9. Security roadmap
| Item | Status |
|---|---|
| ISO/IEC 27001 | Under process Evidence will be shared once available. |
| Independent VAPT (vulnerability assessment and penetration test) | Under process Evidence will be shared once available. |
| Application backups stored in Mumbai only | In progress New backups Mumbai only from 4 November 2026 |
| Security headers on all Being Vakil law firm websites | Done In place since 28 October 2026 |
10. Documents available on request
These documents are shared only with approved requesters, under confidentiality terms. Access is view-only, time-limited and watermarked, and every view is recorded.
11. Report a security issue
If you believe you have found a security weakness in any Being Vakil website or portal, please email advocate@beingvakil.in with a description and the steps to reproduce it. Please do not access client data, disrupt services or publish the issue before we have responded.