Before You Upload a Deed: Security Checks for Verification Vendors

Say you give a verification vendor your sale deed, encumbrance certificate, PAN and a scan of the registered agreement. What happens next? Where is the file kept? Who is able to open it? Does it still exist six months on? Has a copy ended up in some AI training set?

These are reasonable questions, not paranoia. For a bank or NBFC, the third-party-risk team has to ask them before it onboards any vendor that handles borrower data. For a single buyer, or an NRI sending a deed from Dallas, the answers decide whether your most sensitive financial records stay safe.

What follows is that checklist: the questions, the reasoning behind each, and the kind of reply you should hope for. LegiScore's public stance is the worked example since it is open and detailed, yet the same method suits any vendor, ours included.

Which parts of a property document are sensitive?

Many people see property papers as dull paperwork. They are not. One sale deed holds more regulated personal data than most insurance forms.

A typical registered sale deed carries the full legal names of buyer and seller, the parents' names, home addresses, PAN numbers, at times partial Aadhaar numbers, the exact price paid, the loan amount, and how the parties relate (joint owners, spouses, heirs). An encumbrance certificate adds the full transaction history of the asset. A khata or mutation record ties a person to an exact location.

All of this is personal data in Indian law, and PAN and money figures place parts of it nearer the sensitive end. A vendor receiving the file learns the identity and wealth profile of everyone named in it. That makes security on a verification platform the foundation of trust, well beyond an IT footnote.

Which laws apply to a vendor that holds your documents?

Three layers apply in India. It helps to know which gives you the most leverage.

Layer one is the Digital Personal Data Protection Act, 2023. The DPDP Act names whoever decides the purpose and method of processing as the "Data Fiduciary"; that party stays accountable even when a processor does the actual work. A lawful basis (normally consent) is needed, security safeguards are compulsory, and after a personal-data breach the fiduciary must inform both the Data Protection Board and the people affected. The DPDP Rules, 2025 were notified on 13 November 2025. The Board began functioning immediately, but the main fiduciary duties only need full compliance by 13 May 2027. Some duties phase in, yet the statute and its dates are fixed. Penalties go as high as ₹250 crore where security fails.

Layer two matters if the vendor works for regulated lenders. The RBI Master Direction on Outsourcing of Information Technology Services (issued 10 April 2023, in force from 1 October 2023) sets the rules for banks and NBFCs that use IT vendors. Lenders must do risk-based due diligence on every provider, review its condition each year, hold audit rights even where the provider sits outside India, and keep data in India as far as possible. A bank weighing up a verification vendor should expect its auditor to test the vendor against this Master Direction.

Layer three is the contract. Confidentiality clauses, a data-processing agreement and audit rights are what make vague assurances enforceable. Statute sets the minimum; your agreement sets the minimum you actually get.

What should you ask a verification vendor about data security?

Put these eight questions before you upload or sign anything. A vendor that answers them in plain terms is already ahead of one that points to a "bank-grade security" banner.

• Where are my data stored and processed? · Why it matters: the RBI outsourcing rules push storage into India, and banks want certainty about jurisdiction. · A good answer: India-region servers named for documents, app and database, and any offshore step (AI, for instance) declared openly.
• Do you train AI models on my documents? · Why it matters: a deed that enters a training set can never be extracted again. · A good answer: a flat "no", with inputs handled only in transit and not retained by the AI provider under its data-processing agreement.
• Who is able to open my document, and is each access recorded? · Why it matters: misuse by insiders is a more usual route to a breach than outside hackers. · A good answer: role-based permissions plus append-only audit records of state changes, naming the actor and the time.
• How long do you hold my deed once the report is done? · Why it matters: open-ended retention means open-ended exposure. · A good answer: a stated retention period, and a deletion route tied to your data-principal rights under DPDP.
• Is data encrypted while moving and while stored? · Why it matters: interception and theft from storage are elementary threats. · A good answer: TLS 1.2+ in transit and encryption at rest via the storage layer. Honest vendors add whether customer-managed keys exist.
• Which sub-processors do you use? · Why it matters: the safety of your data is capped by the weakest supplier in the chain. · A good answer: willingness to hand over the complete supplier list and their attestations, under NDA, when asked.
• Which certifications do you actually have? · Why it matters: "bank-grade" is a marketing phrase, while ISO 27001 can be verified. · A good answer: the vendor spells out what it is certified for and what it is not, without implying more.
• If there is a breach, how quickly will we know? · Why it matters: DPDP makes notification mandatory, and silence creates contract risk. · A good answer: a committed notification window (DPDP expects 72 hours to the Board) and a named Grievance Officer.

Keep this table. Our own third-party-risk reviewers go through the same one, and it fits any vendor in this field.

Why is data stored in India important?

Data residency means which country's servers physically hold and process your data. When an Indian lender's vendor handles property documents, residency is close to a requirement and not simply a preference.

Here is the weight behind that. The RBI direction on IT outsourcing wants regulated entities to hold data in India. If processing is done overseas, they must be sure the foreign country protects confidentiality and permits audits. When an auditor reads a bank's vendor file, the best line to find is "documents held in India-region object storage", after which there is nothing more to ask. A vague vendor, or one unable to confirm whether a US region keeps copies of borrower deeds, hands the bank an open audit finding to defend.

Put simply: where do documents sit, where are they processed, and which steps cross the border? Banks' risk desks tend to open with this question in the vendor assessments we have responded to. The reply either settles the matter or holds it up.

The LegiScore security page gives a straight reply. Its main database, document and report storage, application and worker services and transactional email are all hosted in India-region infrastructure. Its single offshore step, third-party AI analysis, is disclosed with a limit: providers process inputs in transit and, under their data-processing agreements, do not retain them. An auditor can put that on file.

What should a vendor's retention and deletion policy say?

A verification vendor needs your deed only to produce the report. Once the report is delivered, each further day it holds your document adds risk and gives you nothing.

Ask two things. How long is the deed kept after delivery, and is that a stated period and not "as long as necessary"? And can you ask for deletion, and will the vendor comply? Under the DPDP Act, a data principal can ask for erasure of personal data once its purpose is done, so deletion is a right you can invoke and not a favour.

Watch for the difference between live storage and backups. A vendor can delete your live document while a snapshot still holds a copy until the backup retention period ends. This is usual and normally acceptable. A good vendor admits it, though, and does not claim deletion is immediate everywhere. If they are honest about backups, the other answers are probably honest too.

How do you judge access control and audit logs?

Most leaks of property data do not look like films. An employee opens a file they had no reason to open, or a login is never cancelled after someone leaves. Access control is the defence and the audit log is the evidence.

First check that permissions are role-based, so no support agent can casually pull any customer's deed. Then ask the harder thing: does the system log each time a document is opened, with the person and time? An append-only record of uploads, status changes and privileged actions lets a bank rebuild what happened after an incident, and tells you that any access leaves a trace.

RBI audit rights also come into play. Under the Master Direction, the regulated lender and the RBI itself must be able to audit the service provider. Per-action audit records make that possible. If a vendor cannot say who opened a file last Tuesday, it fails the audit before the auditor arrives.

LegiScore gives concrete detail here. Changes to user-facing state, namely document uploads, case status, acknowledgements and payment events, go into append-only audit records, so the sequence can be rebuilt after an incident. You can test that claim against the platform. It is not just a slogan. (For why banks care, see our article on the audit trail in property verification.)

Will my document be used to train an AI model?

Of all the questions listed, this is the most recent and the one vendors handle worst. When a platform passes your deed into a model that learns from it, fragments of your information can surface later where nobody can control or remove them. A property document inside a training corpus stays exposed permanently.

So put it plainly: do you train your own models, or any third-party model you call, on what I upload? Then read the policy itself rather than the brochure. A good policy treats two matters separately. It states that uploaded documents are not used for training. And it explains what occurs when the vendor sends data to an external AI service, namely whether that provider keeps the inputs or only handles them in transit before discarding them.

According to LegiScore's published position, third-party AI analysis uses external API endpoints, and the providers process inputs in transit without retaining them, per their data-processing agreements. What matters here is not how well one vendor phrased it. You should require this exact assurance in writing from any verification service before a single deed goes up.

Why honesty about limits is a good sign

One test works faster than any certificate logo to see through a pitch: ask the vendor what it does not do.

Claims like "bank-grade security" and "fully compliant, enterprise-ready", with no standard named, give you nothing to check. A vendor that lists its certifications and, alongside, the ones it lacks gives you what is rare: a statement you can verify, from a company that was not cornered into detail.

The LegiScore security page takes the harder path. It says outright that the platform has no ISO 27001 certification, no SOC 2 attestation and no GDPR certification, and then describes what it has aligned with under the DPDP Act. It also adds candid limits: there is no 24/7 staffed security operations centre, and encryption at rest is the cloud default, not customer-managed keys. Nobody gains flattery from that. A risk reviewer still gets more from it than from a row of badges, because it shows where each boundary lies.

Across assessments we have observed, vendors that publish their limitations beat those with polished claims. A risk team exists to find the distance between promise and reality, and a vendor that names that distance first leaves nothing to uncover. Favour that behaviour, in LegiScore and in every other vendor.