arilator

Trust, Security & Regulatory Compliance

Independent router controls. Transparent upstream relationships. Arilator combines an authorized Indian Merchant of Record (GSTIN: 36ABGCA4968F1ZG) for global software procurement with an independent Enhanced API Router for security, policy enforcement, and compliance auditing.

Customer Terms of SaleVendor Reseller TermsPrivacy & DPDP Policy

How our Merchant of Record & Enhanced API Router models work

Authorized Merchant of Record (MoR)

For authorized commercial offerings, Arilator India Private Limited (GSTIN: 36ABGCA4968F1ZG) is the statutory seller of record in India. We contract directly with Indian customers in INR, collect domestic payments, and issue compliant 18% GST tax invoices.

Independent Router Controls & Transparent Upstream Relationships

Arilator Enhanced API Router provides independent PII/secrets protection, policy enforcement, and compliance auditing across compatible vendor APIs—clearly distinguishing authorized commercial resale from independent BYOK integrations.

RBI Payment Data Localization (India Residency)

All Indian payment records, UPI callback verifications, INR prepaid credit ledgers, GSTIN verification logs, and GST tax invoices are processed and stored exclusively in data centers located within India (`asia-south1`) in accordance with RBI payment data localization directives.

Compliant 18% GST Tax Invoicing & GSTR-2B ITC

Every domestic purchase generates an itemized GST tax invoice under Arilator India Private Limited’s GSTIN (36ABGCA4968F1ZG) with real-time verified customer GSTIN, Place of Supply, CGST/SGST or IGST split, and applicable SAC codes (998314 / 997331), enabling eligible GST-registered Indian businesses to claim 18% Input Tax Credit (ITC) in GSTR-2B, subject to buyer GST eligibility and applicable compliance rules.

Multi-Tenant Enhanced API Router & SSRF Protection

Arilator’s Enhanced API Router enforces strict per-customer session isolation, cryptographically hashed API keys (`sk-ari-live-...`), optional `X-Arilator-*` governance decorators, internal header stripping before upstream forwarding, and outbound SSRF network guards.

Prepaid Master Account & Monthly Net-15 USD Settlement

For authorized vendors, Arilator Inc. (Delaware, USA) funds vendor master accounts upfront in USD for resold API/token packages and remits monthly Net-15 wholesale USD settlements for fulfilled subscription orders—backed by immutable cryptographic agreement hashes.

1. Corporate & Contracting Structure

  • Indian Customer Counterparty (Merchant of Record): Arilator India Private Limited (GSTIN: 36ABGCA4968F1ZG, State Code 36, Telangana) acts as the statutory seller of record for all authorized software subscriptions, resold prepaid API packages, and Arilator Enhanced API Router plans purchased by customers in India. All INR payments, UPI and domestic bank collections, and GST tax invoices are issued directly by Arilator India Private Limited
  • Global Vendor Counterparty: Arilator Inc. (incorporated in the State of Delaware, USA) executes commercial reseller schedules with authorized global software vendors, funds prepaid master accounts in USD for authorized API/token distribution, and remits monthly Net-15 wholesale USD settlements through regulated US banking rails.

2. API Governance & Vendor Independence

Arilator maintains a strict distinction between authorized commercial distribution and independent technical API compatibility:

  • Authorized Software & API Resale: Where Arilator has an active commercial schedule with a software or API vendor, offerings are labeled Available through Arilator and sold in INR with a domestic 18% GST tax invoice.
  • Independent Enhanced API Router Integrations (BYOK): Where Arilator provides technical API router compatibility without a commercial reseller agreement, the integration is labeled as an Independent API integration (BYOK). Customers connect their own upstream provider credentials while using Arilator's Enhanced API Router for PII/secrets inspection, policy controls, and compliance logging. Underlying upstream API consumption in BYOK mode is billed directly by the upstream provider under the customer's own account.
  • Header Isolation & Request Integrity: Optional X-Arilator-* control headers configure Arilator's Enhanced API Router decorators on a per-request or tenant-policy basis and are always stripped before forwarding requests to upstream vendor endpoints. By default, router decorators do not persist raw prompt or response bodies.

3. Statement Descriptor, GST Verification & Billing Transparency

When an Indian business or individual pays for authorized software, prepaid API credits, or Arilator Enhanced API Router services, the bank or UPI statement displays Arilator India Private Limited (collected via the designated Arilator India Private Limited UPI handle or domestic NEFT/RTGS collection account displayed at checkout). Every tax invoice clearly identifies Arilator India Private Limited (GSTIN: 36ABGCA4968F1ZG) as the seller of record alongside the applicable product plan and SAC classification (998314 for IT Software & Cloud SaaS or 997331 for software licensing).

For Organization accounts, customer GSTINs are verified in real time against official Indian GST taxpayer records through authorized GST compliance verification services to ensure active registration status and match against the entity's registered Legal Name or Trade Name prior to issuing B2B tax invoices for GSTR-2B Input Tax Credit (ITC) reconciliation (subject to buyer GST eligibility and applicable GST compliance requirements).

4. Regional Data Residency & Infrastructure Security

  • Domestic Billing & Ledger Residency: All Indian payment callbacks, order ledgers, GSTIN verification records, statutory tax invoices, and Arilator Enhanced API Router audit metadata are hosted and processed in secure data centers located within India (asia-south1). Note that when a customer invokes an external third-party API through the router, the forwarded request payload is processed by that upstream API provider in accordance with the upstream provider's own infrastructure and terms.
  • Credential Hygiene & Isolation: Customer Enhanced API Router keys are returned once at provisioning and stored exclusively as one-way cryptographic hashes. Upstream vendor master credentials, BYOK keys, and USD payout banking instructions are encrypted at rest and excluded from public catalog endpoints.
  • Statutory Tax Audit Retention: In compliance with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, all domestic tax invoices, credit notes, and order ledgers are retained immutably in India for a minimum of eight (8) years.

5. Operational Verification Status (Verified Controls vs. Roadmap)

To help enterprise procurement and security teams evaluate Arilator accurately, we distinguish technical controls active in production today from ongoing third-party attestations:

  • Verified & Active in Production Today: Google Cloud Platform asia-south1 (Mumbai, India) hosting for payment ledgers and Firestore collections; real-time Indian GSTIN status and Legal/Trade Name verification; SHA-256 one-way hashing of issued sk-ari-live-* router keys; AES-256-GCM encryption for stored upstream credentials; outbound SSRF private-IP blocking; and in-memory regex/heuristic PII and secret redaction decorators.
  • Infrastructure vs. Application Attestations: Physical data center security and ISO 27001 / SOC 2 infrastructure controls are inherited from Google Cloud Platform (asia-south1). Independent application-level SOC 2 Type II examination for Arilator is on our compliance roadmap and is not yet claimed as a completed certification.

6. Grievance Redressal, Refunds & Escalation

For billing inquiries, GST invoice questions, refund requests, trademark/listing inquiries, or India DPDP Act (2023) data rights requests, contact our compliance and grievance team: