Security at PraVision

At PraVision, security and model safety are treated as primary architecture primitives rather than post-hoc compliance checklists. Because our vertical systems—such as Shaadi Aangan—coordinate personal milestones and multi-host communication in real time, our infrastructure must preserve trust and confidentiality unconditionally. Every autonomous agent, API endpoint, and persistence layer adheres to defense-in-depth principles and tenant-scoped isolation.

Our cloud architecture operates on hardened container environments with minimal attack surfaces: • Edge Termination: Ingress traffic terminates at high-performance edge nodes with automated TLS termination and DDoS mitigation. • Immutable Deployments: Production application bundles are deployed through signed CI/CD pipelines with dependency scanning and static analysis. • Least-Privilege Identity: Studio microservices and worker functions operate under granular IAM roles with temporary credentials, avoiding hardcoded root tokens.

Deploying LLMs and multimodal generators into direct consumer workflows requires active defense against adversarial interaction: • Input Sanitization: Raw user inputs pass through semantic validators that strip prompt-injection patterns and adversarial jailbreak instructions. • Deterministic Validation: Critical transactional intents (such as guest RSVP status changes or event schedule edits) are verified against strict domain schemas before mutating database state. • Output Filtering: Generative outputs pass through toxicity, profanity, and hallucination filters before transmission to users or messaging threads.

Shaadi Aangan connects with guests and hosts through verified WhatsApp channels. To ensure channel integrity: • Every webhook event received from Meta's Graph API is verified against an X-Hub-Signature-256 header using SHA-256 HMAC authentication. • Invalid or unsigned requests are dropped at the edge gateway before reaching our conversational state machine. • Outbound messages use pre-approved WhatsApp Business template schemas and verified phone numbers.

We welcome responsible security research from the community. If you discover a potential vulnerability in any PraVision service or platform: • Please report your findings immediately to security@pravision.in. • Include detailed steps to reproduce, HTTP logs, or proof of concept. • Allow our security engineering team reasonable time to patch the issue before public disclosure. • We commit to acknowledging receipt within 24 hours and keeping you updated as remediation progresses.