CSA STAR Registry

PolyMindsLabs Pvt Ltd builds NamoID, an India-first OAuth 2.1 / OIDC identity provider (SaaS). NamoID lets developers add secure sign-in, social + India-specific login (WhatsApp OTP, DigiLocker, Aadhaar offline KYC), MFA, and multi-tenant user management to their apps.

Security posture - OAuth 2.1 / OIDC with PKCE mandatory on every flow (no implicit or password grant). - RS256-signed tokens via published JWKS; the private signing key never leaves the service. - Refresh-token rotation with replay-chain revocation. - AES-256-GCM encryption at rest (provider tokens, TOTP secrets) under rotatable keys; TLS in transit. - Strict multi-tenant isolation, append-only audit log, Redis-backed rate limiting.

Privacy (India / DPDP Act 2023) - Data residency in AWS Mumbai (ap-south-1). - Aadhaar masked at rest (last-4 + name-hash; full number and XML never persisted). - Data-subject export + deletion; per-connection consent capture.

Security overview, responsible-disclosure policy, and sub-processors: https://namoid.in/security