How we protect your records.
One rule runs through the network: a record moves only when its owner approves. These controls apply across ADi Wallet, Dygital.degree and Checkkbox.
Controls across the network
Consent and purpose
Every request states who is asking, why, and which records. The holder approves or rejects it, and nothing moves before that. Aligned with India's DPDP Act, 2023.
Action-level audit trail
Who did what, when and from where, for every fetch, share, rejection, revoke, issue and signature.
Encrypted in transit and at rest
TLS in transit, AES encryption at rest, and HMAC-signed callbacks between services.
Privacy-preserving lookups
Personal identifiers are hashed for lookups, so a record can be matched without exposing it. Numbers are masked in the app.
Every share can end
A share has a scope and a duration, and the owner can revoke it at any time. Certificates can be revoked or un-revoked with a reason.
Tamper-evident certificates
Every certificate carries a QR code. Certificates are anchored on Hyperledger, and any change to an issued certificate makes its QR check fail.
In each product
You decide what moves
Records from a source are fetched with your consent and re-validated at the source on every request. Aadhaar is re-validated with a fresh one-time password you enter on each request, and only the last 4 digits, your verified name, and the date and result of each verification are kept. Approve or reject every request, see who holds what, and revoke one share or all of them at once.
Signed, anchored, accountable
Certificates carry the signatures the Registrar, Controller of Examinations and Vice-Chancellor upload once; each signature image is stored securely and hashed. Certificates are anchored on Hyperledger. Revoke or un-revoke at row, batch or programme level with a reason, and every issue, signature and answer is logged.
A record of every confirmation
A case opens only with the candidate's consent. Past employers confirm on a secure link and sign by typing their name. We accept a confirmation only when the signer's email domain matches the employer domain in the request; the response is time-stamped and logged, and becomes part of the report. Webhooks to your ATS are HMAC-signed.
Records we check, and how
Records from these sources are fetched or checked with the person’s consent. TheRollNumber is a private company and is not affiliated with any government body; names show where a record comes from.
UIDAI · Aadhaar: identity confirmed with consent and a fresh one-time password on each request; only the last 4 digits, your verified name, and the date and result of each verification are keptIncome Tax Department · PAN and TDS recordsEPFO · employment historyNMC · medical registration, checked against the council registerNUID · nursing registration, checked against the council registerICAI · chartered accountant membership, checked against the council registerUniversities on Dygital.degree · degrees checked against the record the university issuedPast employers · confirmed on a secure link, signed by typed name, email domain matched, time-stamped and loggedCourt records · searched digitally, usually within 15 minutes
Your data and your rights
See, correct or delete your data
How we collect, use and share personal information is set out in our privacy policy. To review, correct or update your information, email support@therollnumber.com. To delete your account, email us with the subject “Delete my ADi Wallet account”.
Questions from your security team
Procurement and information-security questions, and concerns under the Information Technology Act, 2000, can be sent to us by email or to our registered office.