How we protect farmer and partner data.
A farmer's phone number and field location are personal data. We collect as little as the service needs, keep it in India, and let every farmer stop or delete it.
Practices
Data stays in India
The advisory service and its database run on Amazon Web Services in the Mumbai region (ap-south-1).
Encrypted in transit
The app, the partner dashboard and our API are served over HTTPS only. Messages travel through WhatsApp's own encrypted channel.
Access by role
A farmer sees only their own fields. A partner sees only the fields in its own sponsored group, as group reports, never a farmer's phone number. Staff access is limited to the people who run the service.
Tamper-evident records
Every advisory and every derived value is appended to a per-field record chain. Altering a past record breaks the chain, and anyone with an export can check it (see replay).
Consent first
Farmers consent in their own language before any message is sent, can stop with STOP at any time, and can ask for their details to be deleted.
Minimal data
We need a phone number, a field location, the crop and, for orchards, the bahar. We do not ask for Aadhaar, bank details or land records, and we never sell data.
Reference-plot data
Where a research contract includes a soil-moisture and weather kit on a reference plot, readings are sent to our servers over an authenticated, encrypted connection with a key issued for that kit. The data-handling terms, retention period and who may access the exports are set out in the contract.
Exports carry provenance for every value (source, observation time, processing version and record id), so institutions can audit what they publish.
Found a security issue?
Write to contact@varshakrishi.com with the details. We acknowledge reports within 2 working days and do not take action against good-faith research.