What we hold, and why.

Your account particulars (name, email, region), the claims you ask us to verify (company CIN, DIN, DPIIT recognition, GSTIN), the needs you state, the attestations you give and receive, and the outcomes of introductions. Verification numbers are checked against government registries at your explicit request — that request is your consent for that check.

We do not sell your data. We run no advertising. We do not build a feed from your activity. We display no claim we did not verify, and we reveal no contact details until both parties to an introduction consent. Raw identity documents are not stored on our servers — registry checks store outcome evidence (e.g. company name and status), not document images.

Your sworn profile — name, roles, region, verified credentials, company of record, and attestations — is public by design; that legibility is the product. Claims pending review, rejected claims, your email, and your needs are never public.

Verification checks run through Sandbox (sandbox.co.in) against official government sources. Email is delivered by Resend. Data resides on servers operated by us. Institutional dashboards show aggregate and member-level standing only for members enrolled in that institution’s cohorts.

Under the DPDP Act you may access, correct, or erase your record. Erasure removes your profile, claims, needs, and personal data; ledger entries required for other members’ integrity (e.g. an attestation you gave) are anonymised rather than deleted. Write to entry@enorkos.com — the registry answers within 7 days.

Credentials expire and require re-verification after one year. Verification tokens are single-use and short-lived. Passwords are hashed with argon2; sessions ride in httpOnly cookies; every access to verification evidence is audit-logged.