Draft. This text must be reviewed by a qualified Indian lawyer, and the bracketed
details filled in, before it is relied on. Set LEGAL_REVIEWED=yes to hide this notice.
Compliance
How Airotor Live supports compliance with the Indian laws that apply to live workplace video. This page summarises our measures. It is not legal advice to clients.
Laws and how we address them
| Law | What it asks | How Airotor Live supports it |
|---|---|---|
| Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Notice, a lawful basis, reasonable security safeguards, data principal rights, breach intimation, deletion when data is no longer needed, a contact for grievances. | Clear Data Fiduciary and Processor roles; no video recording (data minimisation); org-isolated access; encryption in transit; breach process; Grievance Officer; deletion of organisations and users; policies accepted by every user. Some DPDP Rules obligations come into force in phases, and we track those dates. |
| Information Technology Act, 2000, s.43A and s.72A; SPDI Rules, 2011 | Reasonable security practices for sensitive personal data (including passwords). | scrypt-hashed passwords, hashed stream keys, TLS, role-based access, account lockout, audit trail. |
| CERT-In Directions under s.70B(6), 28 April 2022 | Report cyber incidents within 6 hours; keep ICT logs for 180 days in India; sync clocks to NIC or NPL time servers. | Audit and security logs kept for one year on servers in India; incident-response process; server clocks synced to Indian NTP sources. |
| IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (where applicable) | Published terms and policies, a Grievance Officer, and complaint timelines. | Terms, Privacy and Acceptable Use policies published here; grievances acknowledged within 24 hours and resolved within 15 days. |
| Occupational Safety, Health and Working Conditions Code, 2020, and state labour laws | Safe working conditions; fair treatment of workers. | Helmet-camera safety rules; filming limited to work, at work sites, with notice. Clients remain responsible for consulting workers where their agreements or laws require it. |
Security controls built into the service
- Every camera belongs to exactly one organisation. The media server asks the dashboard before every upload and every view, so isolation does not rely on the web page alone.
- Viewing tokens are signed, tied to one camera and one user, and expire after 15 minutes. Disabling a user, resetting their password or suspending their organisation stops new viewing at once.
- Users must accept the policies and set their own password on first sign-in. Every password change signs out their other sessions.
- Protection against cross-site request forgery, a strict Content-Security-Policy, HSTS, and secure HTTP-only cookies.
- Helmet cameras send video only to the on-site box over WPA2 Wi-Fi. The box forwards it to our servers over encrypted SRT.
Client checklist
- Write down why you are monitoring, and limit it to safety, supervision and operations.
- Give written notice to workers in a language they understand, and put up signage at the site.
- Get consent where required, for example for visitors or where your agreements require it.
- Give dashboard access to as few people as possible, and review your Users page every month.
- Read your organisation's audit log regularly.
- Direct workers' questions and requests to your admin. Airotor Labs will help you answer them.
Contact
Grievance Officer: [set GRIEVANCE_NAME], [set GRIEVANCE_EMAIL]. Security reports: [set SUPPORT_EMAIL].
Version 2026-11-05. Airotor Labs [set legal entity name], [set LEGAL_ADDRESS].