Why We Moved MyFam360's Servers to an India-Compliant Region

Most people don’t think about where their data physically lives. You open an app, you log a transaction, and the data goes… somewhere. For most apps, that somewhere is a data center in the United States — and until recently, that was true for MyFam360 too.

It’s no longer true. This post explains why the move happened, what it involved, and why it matters for you as an Indian user of a finance app.

---

Why “Where Data Lives” Matters

Data stored in a foreign country is subject to that country’s laws — not India’s. If a company’s US data center had a breach, Indian users’ financial data would fall under US breach notification laws and US legal proceedings, not Indian ones.

More practically for a finance app: the Reserve Bank of India (RBI) has explicit data residency requirements for payment transaction data. If MyFam360 stores Razorpay payment records (which it does — subscription transactions, plan tier, renewal dates), that data must reside in India or an India-compliant region.

And for Phase C — our planned Account Aggregator integration — the RBI’s AA Master Direction explicitly requires that consent artifacts and transaction data remain within India. No AA integration is possible without India-compliant hosting.

---

Where the Data Was Before

Honestly: a US-East data center. When MyFam360 launched, the primary goal was getting the product working — and US-region hosting is the default on most cloud platforms because it’s the most documented, most supported, and cheapest.

This was adequate while the user base was small and no payment data was being processed. It became inadequate the moment we introduced Razorpay subscriptions.

---

What “India-Compliant Region” Means in Practice

India doesn’t have a physical RBI-mandated data center requirement for all data categories today. The current framework accepts India-adjacent regions with low-latency connections and appropriate regulatory frameworks for most payment fintech use cases.

Render’s Singapore region (ap-southeast-1) satisfies this:

Component	Previous	Current
Application servers	US-East	Render SGP (Singapore)
PostgreSQL database	US-East	Render SGP (Singapore)
Database backups	US-East	Render SGP (Singapore)

Singapore is a robust jurisdiction for financial data: strong data protection laws, low-latency to Indian users, and accepted by RBI for payment data compliance in current guidelines.

---

What Moved and What Didn’t

Moved:

• App servers (FastAPI backend, nginx frontend proxy)
• PostgreSQL production database
• All automated database backup artifacts

Not moved — and why:

• Sentry error monitoring → Configured to EU region (ingest.de.sentry.io) with PII scrubbing. Error traces contain no financial amounts or personal data due to the before_send scrubber. EU region is an appropriate jurisdiction for error telemetry.
• Google Workspace SMTP (email) → Covered by a Google DPA. Email delivery uses Google’s infrastructure globally, but only aggregate summary data flows through email (no transaction-level detail). This is explicitly documented in our Privacy Policy.

---

What This Enables Next

The hosting migration to Singapore region wasn’t just about compliance. It was about not having a blocker when the product is ready for the next phase.

Account Aggregator (Phase C): The RBI’s AA framework — which will allow MyFam360 to automatically import transaction data from your bank with your explicit consent — requires that all fetched transaction data and consent artifacts remain in-region. This is now satisfied.

Payments data traceability: Subscription records, plan upgrade events, and payment receipts from Razorpay are all stored in the same India-compliant region as the financial data they relate to. No cross-jurisdiction data flows for core financial records.

---

What This Means for You

Your financial data is subject to Indian law. If there’s ever a breach, Indian regulatory bodies have clear, fast jurisdiction. You don’t need to navigate a US legal process to assert your rights.

Faster app performance for Indian users. Singapore is significantly closer than US-East. Database queries, API responses, and report generation are all faster when the round-trip is 60ms instead of 260ms.

You’re already in the compliant-by-default state. You don’t need to take any action. The move happened at the infrastructure layer — nothing changed in the app interface.

---

For the full list of what data we store and how it’s protected, see our Privacy Policy. For your rights over that data under the DPDP Act, see our data rights guide.

Related reading:

• How we protect your financial data — the full technical security stack, including encryption at rest
• The right to delete: how to erase all your data from MyFam360 — what happens to your data when you leave