The controls below are how the platform is actually built. Enterprise buyers get the same honesty in security review that every page of this site practices in marketing.
How does Nishwik secure institutional data? Through platform architecture: JWT-based authentication with role-based access control, tenant isolation so each institution's data is strictly its own, server-side verification of financial computations, audit trails on financial actions, and continuous security review across the microservices backend. Formal certifications are stated only where held — see the note below.
Each item below reflects the platform's actual security posture. Where enterprise buyers need formal attestations, the input-required note applies.
JWT-based authentication with role-based access control — every user works within an explicitly granted scope.
Institutional data is isolated per tenant, with tenant identity derived from authenticated claims rather than client-supplied values.
Financial totals — bills, collections — are recomputed and verified server-side rather than trusted from the client.
Financial actions are logged and traceable, supporting institutional and statutory audits.
The platform undergoes continuous internal security review across its microservices, including remediation-driven hardening cycles.
Personal data handling follows India's DPDP Act, 2023 — consent-based collection, stated purposes, deletion rights, no data sale.
Nishwik does not claim certifications it does not hold. Where a section below is blank, that is deliberate honesty, not an omission.
Detailed infrastructure, certification, and continuity information is shared with enterprise customers during the security-review process that accompanies enterprise proposals.
Enterprise security questionnaires and review calls are welcomed as part of enterprise proposals — reach the team via the contact page.
Enterprise security review is part of the enterprise proposal process — our team answers questionnaires with evidence, not adjectives.