Security & compliance
Kosha is built for regulated, security-conscious organisations. Every control below is part of the product, switchable by edition, and every action leaves evidence an auditor can check.
Product controls
Every event — view, edit, approve, issue, recall, setting change — is appended to a per-organisation chain in which each entry’s SHA-256 hash covers the one before. Deleting or editing history breaks the chain, and anyone with audit rights can verify integrity on demand.
Signatures in the style required by 21 CFR Part 11 and EU Annex 11: re-authentication at signing, the printed name, date, time and meaning of each signature, and a signature manifest on the rendered PDF.
Label documents Public, Internal, Confidential or Restricted (labels are configurable) and give each user a clearance level. Clearance is enforced alongside every other access rule.
Detect PAN, Aadhaar, card numbers and your own patterns on upload, then flag, auto-classify or block. AI sensitive-data detection can suggest a classification from content.
TOTP authenticator apps, optionally mandatory for everyone. Account lock-out after failed attempts, configurable session length and session revocation.
OpenID Connect and SAML: Microsoft Entra ID, Google, Okta, Keycloak and any standards-based identity provider, with automatic user provisioning.
Restrict sign-in to your corporate networks and VPN ranges.
Automatic retention by document class with review, archive or delete disposition.
Freeze documents for litigation or investigation. A hold overrides retention and blocks deletion until released.
Declare final records — immutable and non-deletable — for evidential integrity.
Dynamic user, date and classification watermarks on download; status stamps on issued PDFs.
Expiring, password-protected, watermarked links with download limits — and an organisation-wide switch to disable external sharing entirely.
Architecture
Who can see a document is computed from its state — draft actors, then the originating department, then issue recipients — and materialised into an access list on every change. Lists, search and AI all use the same predicate, so “who can see this?” always has one auditable answer.
Every record carries an organisation identifier and every query is filtered by it in the domain layer. Sovereign deployments are single-organisation by design.
TLS for all traffic in transit. Kosha Cloud encrypts databases, backups and file storage at rest. On-premises, Kosha runs on your encrypted volumes and object storage; we provide hardening guidance.
Passwords are hashed with PBKDF2-SHA-256 (210,000 iterations) via standard WebCrypto primitives. Secrets such as API keys and SSO client secrets are never returned to the browser.
Licences are signed with ECDSA P-256 and verified locally, so air-gapped installations never phone home.
Administrators can be allowed to open any document — and every such access is written to the audit chain. You can also switch this override off.
Deployment & residency
Kosha Cloud
Multi-tenant SaaS hosted in India by default; EU, US or Middle East regions and a dedicated private-cloud region on request.
On-premises / private cloud
Install Kosha on your servers or your cloud account. Your network, your keys, your backups.
Air-gapped
No internet required — local AI models, offline licence verification and signed offline update media. Built for defence, nuclear, critical infrastructure and government.
AI governance
Compliance mapping
Kosha supports compliance; it does not by itself make you compliant. Policies, validation, training and operating procedures remain with you.
| Framework | What Kosha contributes |
|---|---|
| ISO/IEC 27001:2022 | Annex A access control, logging, cryptography, supplier and information transfer controls supported by product features. |
| SOC 2 (Trust Services Criteria) | Logical access (CC6), system operations and monitoring (CC7), and change management (CC8) evidence from the audit chain and configuration export. |
| 21 CFR Part 11 / EU Annex 11 | E-signatures with meaning, re-authentication and manifest; secure, computer-generated, time-stamped audit trails; access controls. Your validation remains your responsibility. |
| India DPDP Act 2023 | Purpose-bound access, DLP for Aadhaar/PAN, retention and deletion, data residency in India, breach-evidence from audit logs. |
| GDPR | Data minimisation, retention schedules, access logging, export and erasure support, EU data residency on request. |
Need the detail? Request our security whitepaper and RFP response library at contact@udgamai.com.
In the live demo, sign in as the compliance manager persona, open the audit log and run an integrity check on the chain.