Discovery plane
Corporate narrative, approved programme dossiers, public MVPs and consented enquiry intake. No credentials, repositories, privileged endpoints or unpublished IP.
LiveQHDM / Trust centre
Connected outside.
Compartmentalised inside.
QHDM’s public ecosystem is designed to feel unified without collapsing security, privacy, intellectual-property or regulatory boundaries.
Control-status disclosure
This page states QHDM’s public-safe baseline and target control model. It is not a certification, completed audit or zero-risk claim. Controls must be evidenced per system before sensitive data, partner IP or regulated activity is accepted.
Partner plane
Identity-verified, purpose-limited access for pilots, diligence and collaboration. NDA, least privilege, expiry and auditable sharing before restricted material moves.
PrototypeCore & IP plane
Private source, security architecture, partner data, invention records and privileged operations. Role-bound, separated and never routed through the public portal.
ResearchSecurity baseline
Private by default. Verifiable by design.
Public credibility comes from evidence and honest disclosures—not source exposure or theatre.
Identity
Phishing-resistant MFA for privileged accounts; separate owner, builder, reviewer and finance permissions.
Source
Private repositories, protected primary branches, review gates and no credentials committed to source history.
Secrets
Runtime secret storage, short-lived access where available, rotation after exposure and environment separation.
Data
Purpose limitation, minimum collection, explicit retention, secure transport and product-scoped permissions.
Delivery
Inspectable releases, dependency review, traceable changes, production separation and rollback-ready versions.
Recovery
Versioned backups where data exists, restoration checks, incident ownership and evidence-preserving response logs.
Regulated perimeter
Launch gates by system type.
The exact facts of a product determine the obligations. Qualified Indian counsel and domain specialists must verify the live model before launch.
Human approval, data rights, model/vendor diligence and purpose-specific notices before sensitive pilots.
Seller/provider diligence, transparent terms, complaint routes and no deceptive or automatic acceptance.
State/aggregator requirements, licensed operators, insurance, safety, grievance and payment gates before booking.
Research and planning only unless an exact activity is delivered through a lawful authorised model.
Age, consent, moderation, grievance, intermediary and child-safety design before scaled user content.
Separate legal structure, funds, data, authority and Election Commission compliance before any operational link.
IP-guarded collaboration
Share the minimum proof needed for the next decision.
- Approved product briefs and outcome demonstrations
- Maturity, limitations and validation evidence
- Corporate, governance and partnership information
- Sanitised architecture without attack paths
- Source code, prompts, models and proprietary datasets
- Credentials, internal endpoints and production configuration
- Unfiled inventions, unpublished research and partner material
- Investor room, cap table and personal information
Current official references
Public policy sources used for readiness architecture.
DPDP Rules 2025Ministry of Electronics & Information Technology ↗Consumer & e-commerce rulesDepartment of Consumer Affairs ↗Mobility aggregator advisoriesParivahan / MoRTH ↗Prepaid payment guidanceReserve Bank of India ↗Political party registrationElection Commission of India ↗
These links support scoping and do not constitute QHDM legal certification. Applicable requirements must be checked again for the exact launch date, state, activity and counterparty.
Responsible contact
Private reporting route due.
The domain mailbox is not yet active. Do not publish suspected vulnerabilities or submit sensitive details through the general partner form. A verified private reporting route will be published after mail authentication is configured.