Why you can trust DigiBharosa
Version 1.0 — 17 October 2026
Millions of people will type their phone numbers and suspicious messages into this service. Here is exactly how we protect them — and what we will never do.
Our promises
- We never ask for your OTP, UPI PIN, card details, Aadhaar number or bank password — not in the app, not by phone, not on WhatsApp.
- What you check is not stored. Screenshots are deleted when the check ends. Your mobile number is never shown to other citizens.
- DigiBharosa never calls you, never asks you to install another app, and never asks for money. Anyone who does is impersonating us.
- Official numbers and websites (1930, cybercrime.gov.in, your bank) are marked Safe and cannot be reported as scams.
- Citizen reports never warn others until a moderator has checked them, and one person with many phones counts once.
How your data is protected
- Encryption in transit (TLS 1.2+, HSTS). Your mobile number, name, e-mail and date of birth are encrypted field by field in the database (the number is found at sign-in through a keyed index, never stored readable); passwords and PINs are stored only as salted bcrypt/scrypt hashes; backups are encrypted.
- Your sign-in is protected by rate limits and lock-outs against guessing; staff accounts need two-factor authentication; every staff action is audited.
- Strict security headers (Content-Security-Policy, no third-party trackers or advertising scripts), and uploads are checked in an isolated sandbox.
- Hosted in India; data minimised by design under the DPDP Act, 2023. We publish what we store on the privacy page.
Independent checks
- Before national launch: an independent security audit by a CERT-In empanelled auditor (web, API, mobile apps and infrastructure), a load test at national scale and a disaster-recovery drill. Summaries will be published here.
- The source of the scam rules is the same on the phone and the server, and is tested against more than 500 real-world cases on every release.
Report a vulnerability
- Found a security problem? Write to security@continuumai.io (see /.well-known/security.txt). Please do not access other people's data or disrupt the service; we will acknowledge within 72 hours and credit you if you wish.