Why you can trust DigiBharosa
Version 1.2 (beta) — 22 October 2026
Several citizens will type their phone numbers and suspicious messages into this service. Here is exactly how we protect them — and what we will never do.
Our promises
- We never ask for your OTP, UPI PIN, card details, Aadhaar number or bank password — not in the app, not by phone, not on WhatsApp.
- What you check is never sold or shared; we keep only a shortened record of each check (see the privacy notice). Screenshots are deleted when the check ends. Your mobile number is never shown to other citizens.
- DigiBharosa never calls you, never asks you to install another app, and never asks for money. Anyone who does is impersonating us.
- Official numbers and websites (1930, cybercrime.gov.in, your bank) are marked Safe and cannot be reported as scams.
- Citizen reports never warn others until a moderator has checked them, and one person with many phones counts once.
How your data is protected
- Encryption in transit (TLS 1.2+, HSTS). Your mobile number, name, e-mail and date of birth are encrypted field by field in the database (the number is found at sign-in through a keyed index, never stored readable); passwords and PINs are stored only as salted bcrypt/scrypt hashes; backups are encrypted.
- Your sign-in is protected by rate limits and lock-outs against guessing; staff accounts can turn on two-step sign-in; every staff action is audited.
- Strict security headers (Content-Security-Policy, no third-party trackers or advertising scripts), and uploads are checked in an isolated sandbox.
- Hosted in our secure cloud infrastructure; data minimised by design. We follow the best practices of the DPDP Act, 2023 (not yet certified) and publish what we store on the privacy page.
How sure a result is
- Checks of messages, links, numbers and payment IDs show a risk score from 0 to 100 (higher means more warning signs); the website check shows a trust score from 0 to 100 (higher means more trustworthy).
- Each result also shows a confidence figure. In this beta it ranges from about 15% to 95% (photo and video deepfake checks at most 75%).
- No result is ever 100% certain: scam methods change frequently and new scams appear every day. Treat a result as guidance, not a guarantee, and confirm through official channels before you pay or share details.
Independent checks
- Before national launch: an independent security audit by a CERT-In empanelled auditor (web, API, mobile apps and infrastructure), a load test at national scale and a disaster-recovery drill. Summaries will be published here.
- The source of the scam rules is the same on the phone and the server, and is tested against more than 500 real-world cases on every release.
Report a vulnerability
- Found a security problem? Write to contact@continuumai.io. Please do not access other people's data or disrupt the service; we will acknowledge within 72 hours and credit you if you wish.