{
    "format": "pulsarcards.trust.evidence.v1",
    "generated_at": "2026-09-17T11:35:17+00:00",
    "claims": {
        "soc2_certified": false,
        "gdpr_certified": false,
        "dpdp_certified": false,
        "dpf_participant_verified": false,
        "rbi_authorised": false,
        "rbi_compliant": false,
        "pci_dss_certified": false,
        "sms_registered": false,
        "can_spam_certified": false,
        "trai_certified": false,
        "trai_registered": false,
        "tcccpr_certified": false,
        "dlt_registered": false
    },
    "operator_recorded": {
        "soc2_status": "none",
        "soc2_period": "",
        "dpf_participation_flag": false,
        "hosting_region": "Operator-declared DigitalOcean Droplet",
        "trai_pe_id": ""
    },
    "controls": {
        "access": "user_detail identities, bcrypt passwords, HttpOnly sessions, hashed api_tokens, org RBAC, staff roles",
        "change": "Git history, additive SQL migrations, docs/DEPLOYMENT.md",
        "logging": "audit_log, request ids, /api/health",
        "backup": "sql/tools/backup.php exists; no RPO/RTO claimed",
        "privacy": "Owner export/delete, consent flags, privacy tickets with a 30-day clock, purpose-minimized analytics",
        "mail": "HTTPS transactional mail (Mailgun or Brevo). No SMTP. No open/click tracking. Marketing purpose is refused.",
        "sms": "No SMS gateway unless PULSAR_SMS_ENABLED=1. SHARE-03 opens the device composer. Gateway env keys are ignored while the switch is off. Not a TRAI registration.",
        "billing": "Ops-issued invoices. Card numbers are refused on writes. Hosted Stripe/Razorpay stay off unless BILLING_HOSTED_CHECKOUT is set. Not a PCI certificate."
    },
    "subprocessors": [
        {
            "name": "DigitalOcean Droplet (operator-controlled)",
            "role": "Hosting — Apache, PHP, MySQL on loopback",
            "data": "Application database and uploaded files",
            "status": "Required for the product. Region is whatever the operator declared."
        },
        {
            "name": "Transactional mail (HTTPS API)",
            "role": "Mailgun or Brevo",
            "data": "Reset codes, invoice notices, and other transactional addresses",
            "status": "Used only when the active provider keys are set. SMTP is not used."
        }
    ],
    "incident": {
        "preserve": "X-Request-Id, pulsar-data/logs/app.jsonl, Apache error log, audit_log",
        "rotate": "Secrets only with a planned dual-write",
        "notify": "Legal drafts the words"
    },
    "notice": "This pack is a product inventory. It is not an audit opinion."
}