CERT-In Incident Reporting and Log Retention Policy

It covers the SorviAI service and our own systems. We follow it for every workspace, wherever the customer is. For the data in your workspace you decide why and how it is used, so you are the Data Fiduciary under the Digital Personal Data Protection Act 2023 and we process it for you; our duty is to tell you quickly and help you. For our own account, billing, support and website data we decide, and the duties are ours. The CERT-In Directions are different: they bind us and you separately, each for our own systems.

We report the cyber security incidents listed in Annexure I to the Directions (the Annex below) to CERT-In within 6 hours of noticing them, or of their being brought to our notice. The clock runs from when we notice an incident, not from when we have understood it, so our first report gives what we know at that point and we send the rest later, as CERT-In’s FAQs (question 30) allow.

• How. By email to [email protected], or by CERT-In’s toll-free phone (1800-11-4949) or fax (1800-11-6969), using the reporting form CERT-In publishes on cert-in.org.in.
• What. Every listed incident, whether or not personal data is involved, and whether it affects our own systems or a customer’s workspace on SorviAI, such as a storefront used for phishing.
• Who watches. Reports reach us at [email protected] and by error monitoring and our hosting and network providers’ notices. Every day, including weekends and public holidays, under our round-the-clock rota.
• Contain and recover. We stop the cause, restore service and preserve the evidence. Our database backups allow recovery to any point in the previous seven days; no restore from backup has yet been tested, so we commit to no recovery time.
• Learn. We record what happened and what we changed, and tell affected customers the outcome.

We follow the incident lifecycle the common standards describe (ISO/IEC 27035 and NIST SP 800-61). We are not certified against either, and the steps are run by hand by our director and senior engineers. A report to CERT-In is not the same as telling you; the next sections cover that.

Our point of contact for CERT-In is Deepak Gupta, Director of SORVI AI LTD, reachable at [email protected] and on +44 20 7509 3731, at Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS, United Kingdom. The point of contact receives CERT-In’s requests and directions, answers them within the time CERT-In sets (section 70B(6)), and keeps the details CERT-In holds for us up to date. The same person is our Grievance Officer, named on our Legal Notice and Grievance Officer page.

One incident can start several clocks at once, and they run side by side.

We tell you what happened, which categories of your data and roughly how many people were involved, when it happened and when we found it, what we have done, the likely consequences, and what you need to do. Where we do not yet know something, we say so and follow up. We do not wait for a complete picture before telling you anything. Under the Directions you report incidents in your own systems yourself; our report to CERT-In does not do it for you.

The Directions ask for logs of all information and communication technology systems to be kept securely for a rolling 180 days, and produced to CERT-In with an incident report or when it orders. Our commitment is to keep the logs of our systems for at least 180 days. The table shows each source as it stands today, including those that keep less or whose period we have not yet confirmed.

Where the logs are kept

Our logs, like all our data, are kept in London, in the United Kingdom, and with the providers named above. No copy is kept in India. CERT-In’s FAQs (question 35) say logs may be stored outside India as long as they are produced to CERT-In within a reasonable time, and we produce them on request. Our team works from India as employees of SORVI AI LTD; their access to the logs is access by the same company, not a transfer to another one.

These are not your books’ audit trail

The logs on this page are our own system logs. They are not the audit trail that the Companies (Accounts) Rules 2014 ask of accounting software an Indian company uses for its books, and the SorviAI audit log does not yet meet that standard. Our Compliance page explains what this means for Indian companies.

We comply with valid legal process, and we check that it is valid first. The fuller rules are in our Abuse Policy; in short:

• CERT-In. We give CERT-In the information and assistance it orders under section 70B(6) of the Information Technology Act, in the format and time it sets. CERT-In’s FAQs (question 38) say a request for logs comes from a CERT-In officer not below the rank of Deputy Secretary to the Government of India, and we check that.
• Interception, monitoring and decryption. The Government can direct these under section 69 of the Act. Such a direction is authorised by the executive, not by a court, and it is confidential: we may not be able to tell you about it.
• Blocking orders. We comply with a blocking order made under section 69A of the Act, which is also confidential.
• Court orders and Government notices about content. Where a court order or a notice from the appropriate Government or its agency tells us that content hosted on SorviAI is unlawful (section 79(3)(b) of the Act), we remove it or disable access to it within 3 hours, as the IT Rules 2021 require.
• Everything else. We disclose only what a request compels, challenge one without a proper basis, direct a request for your business records to you where we can, and tell you before we disclose unless the law or the order forbids it.

Your records stay under your control: nothing in your workspace is deleted automatically, and you decide how long to keep it. This is what we keep, for how long, and where.

A backup is not an archive

Seven days of backups exist to recover the service, not to keep records. They cannot be searched or exported record by record, and they do not meet any retention duty you have under Indian law, such as eight years for books of account (Companies Act 2013, section 128) or 72 months for GST records (CGST Act 2017, section 36). They are also not the daily backup on servers in India that the Companies (Accounts) Rules 2014 ask of an Indian company keeping its books electronically.

Legal holds

Where an authority or a court requires us to preserve data, we preserve it for as long as required, even if it would otherwise be deleted, and we use it for nothing else.

When we investigate, we keep copies of the logs and records involved, untouched, and note who handled them and when. Our audit log is read-only through every interface, but it is not yet tamper-evident, and an audit entry is not written in the same database transaction as the change it records.

The Directions ask for system clocks to be synchronised with the time servers of the National Informatics Centre or the National Physical Laboratory, or with a source that does not deviate from them. Our servers use the time service of our hosting provider, which CERT-In’s FAQs (question 42) allow for systems running in the cloud, and our application records time in UTC with its time zone, as question 40 asks.

These are the types of cyber security incident listed in Annexure I to the Directions. We report any of them that affects SorviAI.

• Targeted scanning or probing of critical networks or systems
• Compromise of critical systems or information
• Unauthorised access to IT systems or data
• Defacement of a website, or intrusion into a website and unauthorised changes such as inserting malicious code or links to external websites
• Malicious code attacks, such as viruses, worms, trojans, bots, spyware, ransomware and cryptominers
• Attacks on servers, such as database, mail and DNS servers, and on network devices such as routers
• Identity theft, spoofing and phishing attacks
• Denial of service and distributed denial of service attacks
• Attacks on critical infrastructure, SCADA and operational technology systems, and wireless networks
• Attacks on applications, such as e-governance and e-commerce
• Data breach
• Data leak
• Attacks on Internet of Things devices and associated systems, networks, software and servers
• Attacks or incidents affecting digital payment systems
• Attacks through malicious mobile apps
• Fake mobile apps
• Unauthorised access to social media accounts
• Attacks or malicious or suspicious activity affecting cloud computing systems, servers, software and applications
• Attacks or malicious or suspicious activity affecting systems related to big data, blockchain, virtual assets, virtual asset exchanges, custodian wallets, robotics, 3D and 4D printing, additive manufacturing and drones
• Attacks or malicious or suspicious activity affecting systems related to artificial intelligence and machine learning

We update this policy when our process or the law changes, and give workspace owners at least 30 days’ notice by email of a change that reduces your rights. A change never lengthens the time in which we tell you about an incident affecting your data. This policy is written in English, and requests in other languages are answered in English. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.