Your Data, Protected and Yours

How programme data is protected, how long it is kept, what IdeaScore AI never sees, and how decisions are traced.How programme data is protected, how long it is kept, what IdeaScore AI never sees, and how every decision can be traced back. Written for the committee, the legal team and the applicants who trust you with their ideas.

See the laws and standards Read our security practice

Our badges

Select a badge to open its entry.

How Your Data Is Protected

The same safeguards for every organisation, on every plan.

Encrypted in transit
Every page and API call uses HTTPS, and browsers are told with HSTS never to fall back to an unencrypted connection.
Encrypted at rest
Our database and storage providers encrypt the disks that hold your data. Passwords are stored only as hashes.
Nightly encrypted backups
Encrypted with AES-256-GCM before they leave the server. We keep 30 daily and 12 monthly copies.
Roles that open exactly what they should
A role sees the pages and programmes its permissions cover, and nothing more.
Private files stay private
Decks and agreements open only for programme staff, the assigned evaluators and the team itself. Shared links expire.
Kept apart from everyone else's
Each organisation's records live in their own database, never mixed with another organisation's.

Where data is held

Customer data is stored in Mumbai, India (database) and the Asia-Pacific region (files), and processed in Singapore (application) and Tokyo (email).Customer Data is stored in Mumbai, India (database) and the Asia-Pacific region (uploaded files, export files and encrypted backups), and processed in Singapore (application) and Tokyo, Japan (email). IdeaScore AI processes the text sent to it outside India.

Read the Sub-processors page

Sign-in, access, backups and Security Posture

Privacy You Can Explain to a Committee

Retention, removal, IdeaScore AI and accountability, each with something in the app to show for it.

Retention rules, legal holds and data requests

Set how long applications are kept, hold a programme when the law asks, and answer applicants' data requests within 30 days.Owners set how long applications are kept after a programme ends, from 6 months to 7 years, then anonymised or deleted, and see what would change before anything runs. A legal hold stops anything in a programme being anonymised or deleted until it is released. Applicants ask for a copy of their data, or its deletion, from their portal, and each request carries an answer-by date 30 days out, as the Digital Personal Data Protection Act, 2023 expects.

The Data and Privacy card answers a legal team's questions from your own settings
Copy for your legal team puts the answers on your clipboard as plain text
The automatic clean-up starts as a dry run that only counts
Whether your set-up meets the law is for your legal team to judge; the card reports the facts

Meridian Research Park· Security

Data and Privacy

What your legal team asks, from your own settings

How long do we keep applications?
2 years after a programme ends, then anonymised
4 programmes follow it
When does the next clean-up run?
Only count (dry run)
Nothing is changed until you switch it on
Is anything on legal hold?
1 programme on hold
Seed Fund 2025 · reason and date kept
Do we answer data requests on time?
All 9 answered within 30 days
Last 12 months
Where is our data stored?
—
See the Sub-processors list

Facts from your settings, with a note on the Digital Personal Data Protection Act, 2023. Not legal advice.

Complete removal on request, and 30 days to change your mind

An applicant's deletion request reaches notes, chats and messages too. Anything your team deletes can be restored by an owner for 30 days.When an applicant asks to be deleted, their details are removed from notes, chats and messages too, while scores and decisions stay fair for everyone else. Anything someone in your organisation deletes, such as a programme, a person, a submission or a file, waits in Deleted items for 30 days so an owner can restore it, and is then removed for good.

Erasure clears date of birth and other personal details too
Items in a programme on legal hold wait until the hold is lifted
Deleted items are never in an export, and only the organisation's owners see them
An erasure request reaches Deleted items at once, without the 30-day wait
Nightly backups keep deleted items only for the backups' own 30 days or 12 months

Anything deleted waits 30 days. Choose Restore, confirm, and it goes straight back where it was.

Names and contact details never reach IdeaScore AI

Names and contact details are swapped for labels before anything is sent. Applicants are told when IdeaScore AI helped, and people decide.Before anything is sent to IdeaScore AI, the names and contact details of the people in your programme are swapped for labels such as Founder 1 or Evaluator A, and put back when the answer returns, for the people allowed to see them. Every IdeaScore AI window says what it reads. Applicants are told when IdeaScore AI helped, and people make every decision.

Roll numbers and similar identifiers are left out of what IdeaScore AI reads
The application form, the applicant portal and decision letters say when IdeaScore AI helped
Your data is never used to train AI
The AI Use Statement sets out exactly where the protection stops

Read the AI Use Statement

The IdeaScore AI certificate designer for Meridian Research Park, with a What it reads panel: how many teams, mentors and judges, never who, and a note that applicants' names, answers and scores are never sent. — Every IdeaScore AI window says what it reads. Names and contact details are swapped for labels before anything is sent.

Every decision, traceable for a grievance or an RTI request

The Decision Trail keeps who decided what, when and on what basis. The audit log records every administrative action in plain sentences.The Decision Trail shows who decided what in a round, when, and on what basis: the score and rank at the time, each judge's score and the note, with every change and undo kept. The audit log records every administrative action as a plain sentence, with sign-in details masked, and exports any range as CSV or Excel.

Changed and Undone marks show where an outcome moved
Every document our support team opens in a support session is recorded in your audit log
Each letter sent, and whether it was delivered or bounced
Reports and the audit log read the same record, so they always agree

Meridian Research Park· Reports · Decisions

Decision Trail · Final round

1
Halcyon Grid #0142
Accepted46.5
How it got here
- Letter sentDelivered · 10 Oct, 11:02
- Outcome confirmed: AcceptedPriya Shah · 9 Oct, 16:20
- Judges' scores47 · 46 · 46.5 of 50
2
Quorum Bio #0127
ChangedAccepted43
3
Farmlight #0139
Waitlisted41.5

The same record as the audit log's Decisions view.

Privacy Inside Every Review

Judges see what they need to judge, and nothing that could tilt a score.

Blind review that holds
Blind review hides affiliation, institution, author and ORCID answers, and takes names out of written answers.
Sensitive answers stay narrow
Sensitive answers reach only the people checking eligibility.
Nominators stay private
Juries never see who nominated a nominee.
Votes counted, voters unlinked
Public vote reach is counted without linking it to any voter.

Laws and Standards We Work To

Each badge opens its entry: what is in place, what is in progress, the evidence and the limits.Each badge opens its entry in the Trust Centre: what is in place, what is still in progress, the evidence, and what it does not cover.

Ready: We are doing the work a law or a procurement rule asks for, and the entry lists what is still open.
Aligned: We follow a framework or a standard without claiming its certificate.
Informed by: A standard shapes our security work; the management system it asks for is still to come.
Partly conforms: Some parts of IdeaScore do not yet fully meet WCAG 2.1 AA. The accessibility statement lists the known gaps.
Self-assessed: Every badge is assessed by IdeaScore, and each entry says so first: not certified by an outside body.
Published, Available: Not standards but facts we publish: a security contact and a software bill of materials.

CSA STAR Level 1, self-assessed

We have answered the Consensus Assessments Initiative Questionnaire v4 ourselves, across all 17 domains and 197 controls of the Cloud Controls Matrix v4.

The answers are available on request.

Read for yourself

Public documents open straight away, with no sign-in.

The Software Bill of Materials (CycloneDX) entry in the Trust Centre, self-assessed by IdeaScore: every component pinned to an exact version, a CycloneDX bill covering the backend and the frontend, the SBOM (CycloneDX JSON) evidence marked Published, and its limits. — Each Trust Centre entry opens with “Self-assessed by IdeaScore. Not certified by an outside body.”, then what is in place, what is in progress, the evidence and the limits.

The Legal Pages

One version of every policy, with its version number and the date it takes effect.

Every legal page

Built to Keep Your Data Safe

14laws and standards we work to

5: data and IT laws
9: security and access standards
3: regions: India, EU, US

See the laws and standards

What Legal Teams Ask First

Customer data is stored in Mumbai, India (database) and the Asia-Pacific region (files), and processed in Singapore (application) and Tokyo (email). IdeaScore AI processes the text sent to it outside India. Every connection is encrypted, disks are encrypted at rest, and nightly backups are encrypted before they leave the server. The Sub-processors page has the full list. Enterprise can also choose self-hosting on your own infrastructure, on request.

The organisation running the programme decides why and how applicants' data is used, and IdeaScore processes it on its behalf under the Data Processing Agreement. Applicants' requests go to the organisation first, which answers them in IdeaScore within 30 days.

Yes. From their portal they can ask for a copy of their data or for its deletion. A deletion removes their details, including date of birth and other personal details, from applications, notes, chats and messages at once, and keeps scores and decisions, without their details, so every other team is still judged fairly.

No. Our badges name the laws and standards we work to, each self-assessed by IdeaScore, and every Trust Centre entry shows what is in place, what is in progress and what it does not cover. None is a certificate.

An owner can export everything at any time as one ZIP: programmes, applications, scores, decisions, people, the audit log and files. After a plan ends you have 90 days to export it, and anything deleted is removed for good after its 30 days.

Bring Your Questions to a Product Specialist

A 30-minute walkthrough of the Trust Centre, the Data and Privacy card and the Decision Trail, with your committee's questions.

Book a demo Start a 7-day trial