POSH portal · Trust & privacy

POSH Trust & Privacy

How the Manas POSH portal handles complaint information: who is responsible, who can see what, which safeguards are in place today, and what is still planned.

Last updated 25 September 2026

Who is responsible for what?

• Your organization (the employer) is the Data Fiduciary for complaint information about its employees. It decides why the information is collected and how the Internal Committee uses it, under the POSH Act, 2013 and the Digital Personal Data Protection Act, 2023.
• Manas Center for Mental Wellness and Counselling is the service provider (Data Processor) that runs the portal on your organization’s behalf. We process complaint information only to provide the portal and only as agreed with you.
• Manas also provides the external member of your Internal Committee. Dr. Priya Dubey Sharma, Founder & Consulting Psychologist, sits on your committee as its external member. In that role she is a full committee member bound by Section 16 of the POSH Act, and her findings are her own, not directed by the employer or by Manas.

We sign a Data Processing Addendum with each client that sets out these roles in detail. For the Manas account and billing details of your organization’s own users, Manas decides how that data is used and is responsible for it directly.

What information does the portal hold?

• Complaints: the complainant’s name and contact details (if given), the respondent’s name, the account of what happened, the office concerned and the date received.
• Case records: stages, statutory due dates, hearing notes, statements and case documents uploaded by the committee.
• Committee details: names, roles, email addresses and phone numbers of Internal Committee members, and their portal accounts.
• Company details: company name, offices, headcount, plan and payment status, and the documents generated for your committee.
• Committee records: training sessions and certificates, and signed committee appointment letters.
• Access records: a log of who viewed a case, downloaded a case file or took a case action, and when.

The portal is hosted on Hostinger servers in Mumbai, India. Backups are managed by Hostinger.

Who can see complaint details?

• Your Internal Committee members, each with their own portal login, for the committees they sit on and no others. When a member is removed or their access is revoked, their access ends straight away.
• Your external member, Dr. Priya Dubey Sharma.
• Manas staff who support your committee and administer the portal. Their case views, case-file downloads and case actions in the portal are logged in the same way as committee members’.
• Owners and HR who are not on the committee see only the case reference, status, date received and statutory due dates. They do not see names, contact details, the account of what happened, case notes or files.

If an owner or HR person is appointed to the Internal Committee, they see cases as a committee member. Manas and your external member receive an email whenever anyone is given, or loses, committee access, so these changes are visible to someone independent of management.

If a complaint is about the employer or the business owner, the POSH Act directs it to the Local Committee set up by the District Officer. A complainant can also contact the external member directly using the details on the office poster.

Safeguards in place today

• Private complaint links. Each office gets its own hard-to-guess complaint link and QR code. The complaint form is available in English and Hindi, and a privacy notice is shown in both languages.
• Status check for complainants. A complainant can look up the status of her complaint with her tracking code. The lookup shows status only, never case details.
• Committee-only case details. Full case details open only for the committee, the external member and Manas support staff, as described above.
• Alerts go to the right people. A new complaint alerts the committee members, the external member and Manas, not the business owner’s account. Alert emails carry no complaint details; people sign in to read the case.
• Tamper-evident access trail. Case views, case-file downloads, case actions and refused access attempts in the portal are logged with the person concerned. Each log entry is chained to the one before it, so later changes to the log can be detected.
• Access-change emails. Manas and the external member are emailed every time committee access is granted or removed.
• No advertising or analytics trackers on the complaint form, case pages or portal. These pages are also marked not to be stored in caches or shown in search engines, and do not pass their address on to other websites.
• Protected case files. Case documents are served only through an access-checked download, to the committee and Manas. Signed committee appointment letters are stored privately in the same way.
• Protected signed documents. Dr. Priya’s signature and the Manas seal are not published on the web. Signed documents are issued only to active accounts; before that, documents are watermarked drafts without a signature.
• Verifiable documents. Issued documents are frozen at the time of issue, and anyone can check online that a Manas-issued document is genuine and unchanged.
• Your data on request. We can export your organization’s portal records for you.
• Secure connections. Every page is served over HTTPS, and browsers are told to use a secure connection every time. Standard browser security headers are set across the site.
• Limits on misuse. The complaint form has a submission limit. If the limit is reached or a complaint cannot be saved, the person sees an honest error with the external member’s contact details, and Manas is alerted. The site does not publish its list of user accounts.
• Safe payments. Payments are handled by Razorpay, so card and UPI details never reach our servers.

Planned

These are on our roadmap. They are not in place yet, and we will update this page as each one goes live.

• Planned: encryption of stored complaint content and case files, with a separate key for each company.
• Planned: two-factor sign-in for everyone who can open a case.
• Planned: a copy of the access log kept off the web server.
• Planned: our own encrypted backups, with regular restore tests.
• Planned: an independent security test by a CERT-In empaneled auditor.
• Planned: hosting the portal separately from our main website.
• Planned: a published retention schedule with automatic deletion.
• Planned: a private way for complainants to add statements or evidence to their case.

Service providers we use

These providers help us run the portal. We never sell data and never use complaint information for marketing. The portal does not send data to our marketing, messaging-automation or analytics tools.

We tell clients before we add or replace a provider that can see complaint information, as set out in our Data Processing Addendum.

Keeping and deleting data

• We keep complaint and case records for as long as your agreement with us runs, or for any longer period your organization instructs us to keep them for legal reasons.
• Your organization can ask for an export of its portal records at any time.
• At the end of the engagement, we return or delete your organization’s data as agreed in your service agreement, subject to records the law requires to be kept.
• Backups are managed by Hostinger.

What happens if something goes wrong?

If we become aware of a security incident affecting your organization’s data, we commit to:

• notify your organization without undue delay, and in any case within 72 hours of becoming aware of it, with what we know and what we are doing about it;
• report the incident to CERT-In within 6 hours where the CERT-In Directions of April 2022 apply;
• give your organization the information and help it needs to meet its own duties to notify the people affected and the Data Protection Board of India under the DPDP Rules, 2025.

Requests about personal data

Because your organization is the Data Fiduciary for complaint information, requests to access, correct or erase that information are decided by your organization and its Internal Committee, which must also respect the confidentiality rules in Section 16 of the POSH Act.

If a request about complaint information reaches us, we pass it to your organization promptly and help it respond. Requests about a Manas account or billing record can be sent to us directly.

Contact and grievances

Please do not send complaint details by email to this contact. If you are raising a workplace complaint, use your office’s complaint link or contact your Internal Committee.

What questions do employers ask about POSH data?

Who can see complaint details in the Manas POSH portal?

Your Internal Committee members, each with their own login and only for the committees they sit on; your external member, Dr. Priya Dubey Sharma; and Manas support staff, whose case views and actions are logged. Owners and HR who are not on the committee see only the case reference, status, date received and statutory due dates.

Where is complaint data stored?

On Hostinger servers in Mumbai, India. Backups are managed by Hostinger.

Who is the Data Fiduciary under the DPDP Act, 2023?

Your organization, the employer, is the Data Fiduciary for complaint information about its employees. Manas Center for Mental Wellness and Counselling is the Data Processor that runs the portal for you, and signs a Data Processing Addendum with each client. MeitY: data protection framework.

Is the portal security-certified?

No. Manas does not hold any security certification, and the portal has not yet had an independent penetration test. This page lists only what is in place today, and marks everything else as planned.

What if a complaint is about the business owner?

The POSH Act directs it to the Local Committee set up by the District Officer. A complainant can also contact the external member directly using the details on the office poster. POSH Act, Section 6.

Is the complaint information kept confidential by law?

Yes. Section 16 of the POSH Act bars making known to the public, press or media the contents of a complaint, the identity of the people involved, the conciliation and inquiry proceedings, the recommendations and the action taken. The portal is built around it. POSH Act, Section 16.

More on POSH compliance