One sign-in. Every Dhruvanta product. Built for B2B India.

Vault envelope-encrypted PII

PrintAnywhere stores customer addresses + GSTINs as Vault envelope-wrapped ciphertext. The data key never leaves the requesting tenant boundary.

Plan-gated PII access

Reads of decrypted PII are gated on tenant subscription tier and per-route ACLs from the service-control-plane — a starter-tier admin cannot peek into a pro-tier-only field.

Cross-product audit trail

A 4-way audit aggregator covers Dhruvanta One, PrintAnywhere, Dhruvanta Sign, and Dhruvanta CLM — all products share one canonical 10-field row shape that surfaces in /admin/audit.

Multi-key JWKS rotation

ES256 signing keys carry version IDs; new keys land alongside old ones with a 24-hour grace window so downstream products never see a token forged under a key they have not yet seen.

Redis-Streams email pipeline (coming soon)

The current email pipeline runs in-process. An upcoming upgrade moves email dispatch to a Redis-Streams-backed background worker so user-facing requests never block on SMTP.

Zero-downtime JWKS rotation

Multi-key JWKS publication means key rotation never freezes downstream products. Old + new keys coexist for 24h; products discover the new key on cache refresh.

DB-side payroll computation (BigDecimal HALF_EVEN)

Payroll math runs inside the database with BigDecimal HALF_EVEN rounding so paise-precision results are deterministic and reproducible across Postgres replicas.

Idempotent webhook delivery

Every webhook emit goes through an outbox row protected by a UNIQUE delivery_id constraint — duplicate emits collapse at the DB layer before they reach your endpoint.

Daily Postgres backups + 30-day PITR (Phase 9)

Managed daily snapshots and 30-day point-in-time recovery are scheduled for Phase 9. No backup pipeline is wired today — please do not rely on the platform for archival.

DIY HR CRUD export

The /hr/employees CRUD surface is live. Tenant admins can pull employee snapshots on demand for offline backup.

DIY audit aggregation export

/admin/audit surfaces the 4-product canonical audit feed; rows can be exported as CSV/JSON via the existing API.

DIY marketplace product feed export

Marketplace product-feed sync exposes the canonical product list as a polled JSON feed — your downstream system stays the source of truth.

ES256 SSO handoff to 5 product audiences

Dhruvanta One mints 30-second-TTL ES256 JWTs; PrintAnywhere, Dhruvanta Sign, Dhruvanta CLM, and two reserved audiences validate against the published JWKS. One click opens any product without a second login.

Webhook ingestion (HMAC-SHA256)

The inbound webhook receiver accepts signed events from any product with HMAC-SHA256 verification and a per-tenant secret — no shared credentials.

Webhook emit to your endpoints

Dhruvanta Sign signing events and Dhruvanta One domain events are funnelled through an idempotent outbox and land on whatever endpoint your tenant subscribes.

Service-control-plane fine-grained ACLs

The service-control-plane exposes per-route, per-tier, per-tenant ACLs so you can carve a partner-only API surface without forking the codebase.

common-services API integration (coming soon)

An upcoming update will surface OTP/SMS/push notifications behind a tenant-scoped HTTP API so downstream products can trigger messages without direct SMTP or SMS provider access.

Email support (India business hours)

Reach the team at support@dhruvantasystems.com during India business hours (Mon-Fri, 09:00-18:00 IST). Reply SLA is one business day for paid tiers, best-effort for free.

Live chat with engineering team (Phase 9)

An in-app live chat surface staffed by the engineering team — not a frontline-only queue — is on the Phase 9 roadmap. We will announce it on the dashboard before it goes live.

24/7 live support from experienced engineers (Phase 9)

True 24/7 coverage staffed by senior engineers (not a tier-1 outsource) ships in Phase 9. Until then, email is the canonical channel.

Transparent changelog

Platform changes are logged publicly in the Dhruvanta governance repo. A hosted status page with uptime history is on the roadmap.

Canonical 10-field audit row

Every product (Dhruvanta One, PrintAnywhere, Dhruvanta Sign, Dhruvanta CLM) writes audit events into the same 10-field canonical shape — making cross-product correlation a query rather than an integration project.

JWKS rotation grace period (24h)

Old + new signing keys coexist for 24 hours during a rotation. No downstream cache invalidation, no coordinated restart, no token forging window.

Idempotent webhook delivery (UNIQUE delivery_id)

Webhook outbox rows enforce UNIQUE on delivery_id at the DB layer. Even rolling-deploy double-emits collapse to a single row before they leave the platform.

Zero-downtime deploy runbook (in progress)

The platform-wide zero-downtime deploy runbook (DB migration ordering, signal handling, drain windows) is being finalised. Per-product deploys are already non-blocking; the written standard formalises it.

India tax-id verification at signup

GST + PAN verification is built into the B2B-only signup flow. Personal-email signups are rejected at the API layer; business signups are validated against tax-id regex + format checks.

GSTIN + PAN handling

Tenant records carry GSTIN and PAN alongside the canonical legal name; downstream products see a single, validated identity.

INR-first pricing with paise precision

Distributor pricing is INR-first with paise-precision BigDecimal arithmetic — no float drift, no currency-conversion side-effects on the hot path.

Five-tier subscription plans

free / starter / pro / pro_ai / enterprise — see /pricing for the full feature matrix and the per-product unlock map.