DocsAPIExamples
v0.1.0npm install →

Company

Compliance Framework

Auron never custodies INR. Fiat settlement executes exclusively through licensed partners. This document explains Auron's regulatory posture, obligations, and what each party is responsible for.

NOTE
Auron's licensed settlement partners — OnMeta (FIU-registered) and Razorpay X (RBI-licensed) — handle the regulated fiat leg. Auron's role is verification, routing, state, and proof.

Regulatory coverage by layer

USDC transfer (Solana)User + Phantom

User self-custodies until the moment of transfer. Phantom is the licensed wallet. Auron receives USDC only after voluntary on-chain transfer.

INR conversionOnMeta

FIU-registered crypto off-ramp. Files VDA transaction reports with Indian tax authorities. Handles AML/KYC on the fiat leg under RBI framework.

UPI payoutRazorpay X

RBI-licensed payments platform. Handles UPI transfer, payout ledger, and FEMA-compliant FX conversion as fallback.

Settlement stateAuron

Maintains audit trail, enforces spend limits, verifies on-chain proof, and stores cryptographic receipts. Does not touch fiat.

KYC (Know Your Customer)

Auron's KYC obligation is to verify the identity of users who initiate settlements above regulatory thresholds. The system is built but gated — KYC is enforced at the middleware level via Supabase session check, with status tracked in the kyc table.

KYC tiers

Tier 0 — Unverified₹10,000 / monthWallet connect only
Tier 1 — Basic₹1,00,000 / monthPAN card + selfie
Tier 2 — Full₹10,00,000 / monthAadhaar + PAN + bank proof

KYC verification is handled through a provider-agnostic integration layer (lib/kyc.ts). Sumsub is the default provider. The middleware checks KYC status on every payment initiation — not just at signup.

AML (Anti-Money Laundering)

Auron operates three AML controls:

01
Transaction monitoring

All payments are screened against velocity rules: >10 transactions in an hour, duplicate payments within 60 seconds, amounts that spike significantly above a user's historical average. Flagged payments route to the risk scoring engine (0–100 score) before any settlement proceeds.

02
Spend limits

Per-transaction cap (₹2,00,000 / 2,500 USDC) and daily cap (₹5,00,000 / 5,000 USDC) are enforced server-side. User-configured ceilings can only be lower, not higher, than these limits. API key holders have per-key daily limits set in the database.

03
Licensed partner screening

OnMeta performs wallet screening and sanctions checks on the fiat leg as part of their FIU registration obligations. Razorpay X screens UPI IDs against RBI blacklists. Auron does not duplicate this — we rely on partner coverage for the fiat settlement layer.

Data retention

Transaction records7 years

RBI requirement for payment records

Status history (audit log)7 years

Append-only — never deleted or modified

KYC documents5 years post-offboarding

PMLA / VDA reporting requirement

Chat messages90 days

Operational debugging only, then purged

IP addresses (rate limit)60 seconds

KV TTL — not persisted to database

PIN hashUntil user deletes account

argon2id hash only — raw PIN never stored

Audit logs

Every payment has an immutable audit trail in the status_history table. The trail is append-only — rows are never updated or deleted, enforced at the database level via row-level security policy. Cryptographic receipts (GET /api/receipt/:id) are permanently accessible to payers and payees without authentication.

The receipt hash (SHA-256 of canonical fields) allows independent verification that Auron's records have not been altered after the fact — a tamper-evident log that does not rely on trusting Auron's database.

VDA reporting (India)

Under India's Prevention of Money Laundering Act (PMLA) amendment (2023), VDA (Virtual Digital Asset) service providers must report transactions above threshold to the Financial Intelligence Unit (FIU-IND). This obligation is covered by OnMeta, which holds FIU registration and files reports on Auron's behalf for all settlements that flow through their system.

Auron's obligation: maintain user KYC records, enforce spend limits, and provide transaction data to OnMeta on request. All of these are implemented.

Incident response

P0 — Funds at riskSLA < 15 min

Pause all new settlements immediately. Trigger auto-refunds for in-flight payments. Notify users.

P1 — Settlement failureSLA < 1 hour

Auto-recovery kicks in (worker retry + provider switch). Manual escalation if auto-recovery fails after 3 attempts.

P2 — Data incidentSLA < 4 hours

Isolate affected records. Notify impacted users within 72 hours per DPDP Act requirements.

P3 — Degraded serviceSLA < 24 hours

Status page update. Root cause analysis. Post-mortem within 7 days.

DANGER
Disclosure of a security vulnerability involving user funds must be treated as P0 regardless of whether exploitation has occurred. Contact anirudhvashisth2006@gmail.com for responsible disclosure.
Next →Quick Start