Identity Verification
We verify who holds every IP address we hand out
DataDack Cloud allocates public IP addresses from its own pool. Indian law makes us responsible for knowing which customer holds which address, for how long, and for what purpose. This page sets out exactly what we ask for, when we ask for it, how long we keep it, and what we will never do with it.
Why we ask
Verification is a consequence of running our own network
Resellers can pass the question of identity upstream. We cannot — the addresses are registered to us, so the accountability for their use is ours.
We allocate the IP addresses ourselves
DataDack Cloud assigns public IPv4 and IPv6 addresses from our own allocated pool rather than reselling another provider's. Every address that reaches the internet from our network is traceable to us — so we have to know, and be able to prove, which customer was using it and when.
CERT-In Direction 20(3)/2022
Cloud, VPS and data-centre providers operating in India are directed to register and maintain validated customer records — name, address, contact details, ownership pattern, period of hire, purpose, and the IP addresses allotted — and to retain them for at least five years.
Abuse traceability
When an IP in our range is reported for spam, scanning or attack traffic, verified records let us identify the responsible account in minutes rather than losing the whole range's reputation. Verification protects every customer sharing our address space.
Fraud and account-takeover prevention
Prepaid infrastructure is a common target for stolen payment instruments. Tying an account to a verified identity makes card fraud, credit abuse and takeover of an existing tenancy substantially harder.
When it applies
What triggers a verification request
Verification is not a barrier to opening an account. You can sign up, provision resources and run them on private VPC networking without submitting a single document. It becomes mandatory at these points:
Before the first public IPv4 or IPv6 address, static IP or public load-balancer endpoint is allocated to your account.
Before a quota increase that raises the number of public IP addresses beyond the default allowance for your account.
Before outbound SMTP (TCP port 25) or any bulk-mail capability is enabled on your resources.
When the account holder, registered entity, authorised signatory or beneficial ownership of the account changes.
When an abuse complaint, fraud signal, chargeback or anomalous usage pattern is raised against your account.
When we receive a lawful request from a court, regulator or law-enforcement agency relating to your account.
As a periodic refresh — every 24 months, or sooner if a submitted document has expired.
Documents
Individuals and sole proprietors
Submit a photo identity, a proof of address and a liveness capture. We ask for the minimum set that satisfies the regulation — nothing on this list is optional curiosity.
| Document | What it establishes | Notes |
|---|---|---|
| Permanent Account Number (PAN) | Primary identity — Indian residents | Required for Indian individuals and sole proprietors; the name must match the account holder. |
| Aadhaar (masked), Passport, Voter ID or Driving Licence | Photo identity | Any one. Where you choose Aadhaar, submit only the masked form or offline e-KYC XML — we do not ask for, and do not store, the full 12-digit Aadhaar number. |
| Utility bill, bank statement, rent agreement or passport | Address proof | Dated within the last three months for bills and statements. |
| Live selfie or short video capture | Liveness check | Matched against the photo identity to confirm the document belongs to the person submitting it. |
| GST registration or Udyam/MSME certificate | Sole proprietors only | Establishes the business under which the account operates, where one exists. |
Documents
Companies, LLPs and partnerships
For an entity we verify both the entity itself and the individual authorised to operate the account on its behalf.
| Document | What it establishes | Notes |
|---|---|---|
| Certificate of Incorporation with CIN, LLP agreement, or partnership deed | Constitution of the entity | Whichever applies to your legal form; a society or trust deed is accepted for non-corporate entities. |
| PAN of the entity | Tax identity | In the registered name of the entity, not of a director or partner. |
| GSTIN | Tax registration | Where the entity is registered. Also used to issue a compliant tax invoice. |
| Registered office address proof | Address | Utility bill, lease, or the MCA master-data record for the entity. |
| Board resolution or authorisation letter | Authority to bind | Naming the person authorised to open and operate the account on the entity's behalf. |
| Identity and address proof of the authorised signatory | Individual behind the account | Same document set as for individuals, for the named signatory only. |
| Beneficial ownership declaration | Ownership pattern | Details of any person or entity holding more than 25% of the customer, as required by CERT-In. |
Documents
Overseas and non-resident customers
Customers outside India are verified against equivalent documents from their home jurisdiction. The record we have to keep is the same.
| Document | What it establishes | Notes |
|---|---|---|
| Passport, or national identity document with a photograph | Photo identity | Machine-readable pages, in colour and unedited. |
| Company registration extract from the home jurisdiction | Constitution of the entity | Notarised or apostilled where the document is not in English. |
| Tax identification number in the home jurisdiction | Tax identity | Used for invoicing and for the withholding position on cross-border charges. |
| Declaration of purpose of hire | Purpose | A short written statement of the workload you intend to run, recorded against the IP allotment. |
Process
How verification runs
- 1
Start verification in the console
Open Account → Verification. The console tells you which document set applies to you — individual, Indian entity, or overseas customer — before you upload anything.
- 2
Upload over an encrypted channel
Documents are uploaded directly over TLS and encrypted at rest the moment they land. They are never sent by email, and we will never ask you to email them.
- 3
Automated checks run first
We validate document format and expiry, check the name against the account and payment instrument, and run a liveness match on the selfie. Most straightforward submissions clear here.
- 4
Human review where needed
Anything the automated checks cannot settle goes to a trained reviewer. We may ask a single clarifying question rather than rejecting a submission outright.
- 5
Outcome and IP allocation
Individuals are usually verified within one business day; entity and overseas verification can take up to three. Once approved, public IP allocation and the associated quotas unlock automatically on your account.
Records
What goes into the IP allotment register
Separately from your documents, we maintain a register tying public addresses to accounts. These are the fields CERT-In Direction No. 20(3)/2022 requires an Indian cloud or VPS provider to hold:
The validated name, registered address, contact number and email address of the customer.
The ownership pattern of the customer, including beneficial owners above the declared threshold.
The period of hire, with the start and end dates of each service.
Every public IP address allotted to and used by the account, with allotment and release timestamps in IST.
The email address, source IP address and timestamp used at the time of registration and onboarding.
The stated purpose for hiring the service.
This register is disclosed only to a regulator, court or law-enforcement agency acting under lawful process, or where an abuse investigation requires us to identify the source of traffic from our range. It is never shared with other customers or with commercial third parties.
Retention
How long we hold each category
Retention periods here are set by regulation rather than by preference, so we state them plainly — including the parts that limit what we can delete on request.
- Verification documents and KYC records
- Retained for five years from the end of the hire or the closure of the account, whichever is later, in line with CERT-In Direction No. 20(3)/2022. We cannot delete these earlier on request while that obligation is live — but they stop being used for anything other than compliance the moment your account closes.
- IP allotment register
- Retained for five years after an address is released back to our pool, so that historical attribution of an address to an account remains possible.
- System and network logs
- Retained securely for a rolling 180 days within Indian jurisdiction, as directed by CERT-In, and then purged. Logs are not mined for profiling or marketing.
- Billing and tax records
- Retained for the period required by Indian tax and accounting law, independent of the KYC retention period. See the Billing Privacy Notice.
Safeguards
How your documents are protected
Documents are stored encrypted at rest, only in our Noida region, and never replicated outside India.
Access is limited to a small set of trained verification and compliance staff on a strict need-to-know basis, and every access is audit-logged.
We do not use verification documents for marketing, profiling, model training or credit scoring, and we never sell them.
We do not ask for, store, or process the full 12-digit Aadhaar number; masked Aadhaar and offline e-KYC XML are the only Aadhaar forms we accept.
We do not ask for your card PIN, CVV, net-banking password, OTP or any account credential — no member of our staff will ever request these.
Documents are disclosed outside DataDack only to a regulator, court or law-enforcement agency acting under lawful process, and to the verification providers who act as our processors under contract.
If verification is not completed
What happens to your account
We would rather constrain an account than terminate it, so the effects are graduated and reversible up to the point of falsified documents.
Public IP allocation is withheld. Your account can still be created and you can still provision resources on private VPC networking, but nothing will be reachable from the public internet.
Public-IP quota increases, outbound SMTP and bulk-mail capability remain disabled.
Where verification is not completed within 15 days of a request on an account that already holds public IPs, we may reclaim those addresses after written notice, and may suspend the affected resources.
Submitting forged, altered or borrowed documents is grounds for immediate termination under the Terms of Service without refund of consumed usage, and is reported to the appropriate authority.
Repeated failed attempts using different identities on related accounts are treated as an abuse signal and may lead to a platform-wide block.
Your rights
Access, correction and grievances
Under India's Digital Personal Data Protection Act, 2023 you can access the personal data we hold about you, ask us to correct it, and raise a grievance about how it was handled.
Access and correction
Your verification status and the details on record are visible in the console under Account → Verification. To correct a name, address or entity detail, submit the corrected document — we update the record rather than keeping both.
Grievance redressal
Write to privacy@datadack.com with “Grievance” in the subject line. Our Grievance Officer acknowledges within 7 days and responds substantively within 30 days. If you are unsatisfied, you may approach the Data Protection Board of India.
FAQ
Verification, answered
- Why does DataDack Cloud need my ID proof to give me a server?
- Because we allocate public IP addresses from our own pool rather than reselling someone else's. Under CERT-In Direction No. 20(3)/2022, an Indian cloud, VPS or data-centre provider must maintain validated records of who hired the service, for what period, for what purpose, and which IP addresses were allotted to them — and must keep those records for five years. Verification is what lets us hold those records accurately, and it is what keeps our address space clean for every customer on it.
- Do I need to complete KYC if I only use private networking?
- No. You can create an account, provision virtual machines and run them inside a VPC on private addressing without completing verification. Verification is triggered at the point where a public IP address, a static IP, a public load-balancer endpoint or outbound SMTP is requested.
- Does DataDack Cloud store my Aadhaar number?
- No. We accept only masked Aadhaar or the offline e-KYC XML, and we neither request nor retain the full 12-digit Aadhaar number. If you would rather not submit Aadhaar in any form, a passport, voter ID or driving licence is accepted in its place alongside your PAN.
- How long does verification take?
- Individual verification is usually complete within one business day. Verification for a company, LLP or partnership, and for overseas customers, can take up to three business days because entity documents and authorisations are reviewed by a person.
- Can I ask DataDack to delete my verification documents?
- You can ask, and we will delete them once the statutory retention period ends — five years from the end of the hire or account closure under CERT-In Direction No. 20(3)/2022. Until then, the records are held solely to meet that obligation and are not used for any other purpose. All your other data-principal rights under the DPDP Act, including access and correction, apply immediately.
- Can I be allocated a specific public IP address?
- No. Addresses are assigned from available capacity in our pool and you have no claim to any particular address. We do not warrant that an allocated address is absent from third-party blocklists, and we may change an allocated address with prior written notice where operationally necessary. See the Terms of Service for the full position.
Related policies
Questions about a verification decision, or need a bulk onboarding process for a large team? Email verification@datadack.com. This page describes our operating practice and is not legal advice; the binding obligations sit in the Terms of Service and Privacy Policy.