🛡️
Data Integrity & Anti-Fraud
How NagarDrishti keeps civic data trustworthy
🌐 Geo-Verification
Every submission is validated against a three-layer geospatial check before it enters the live dataset:
✓
Device GPS + Network triangulation. We cross-reference the device's reported coordinates with its network-inferred location. A discrepancy greater than 500 m triggers a manual review flag.
✓
Civic boundary validation. Submissions must fall within a recognised ward or municipal boundary as defined by the local body's GIS layer (sourced from NULM / Digital India GIS portal).
✓
Category-location plausibility. A "River / Lake Pollution" report filed in a ward without any mapped water body, or a "Fire Safety" report from a residential plot zoned as park land, is automatically downgraded to pending and routed for human review.
India-specific: We use Survey of India 1:10,000 scale ward maps and ORSAC / NRSC satellite imagery layers to maintain boundary accuracy for all 35 state/UT capitals and 50 Class-I cities.
🔁 Duplicate Detection
Duplicate reports waste municipality bandwidth and inflate incident counts. NagarDrishti runs a four-pass deduplication pipeline on every incoming submission:
| Pass | Method | Threshold | Action |
|---|---|---|---|
| 1 | Geo-radius cluster (same category within 50 m) | Within 24 h | Merge into primary incident; increment corroboration count |
| 2 | Image perceptual hash (pHash ≥ 95% match) | Cross-session | Flag as likely re-submission; suppress duplicate, credit original reporter |
| 3 | NLP text similarity (TF-IDF cosine > 0.88) | Same ward + 48 h window | Soft-merge; keep both records linked for audit trail |
| 4 | User fingerprint + category + ward | Within 6 h | Block re-submission with user notification |
Multiple citizens reporting the same pothole or garbage dump is a feature, not a bug — the corroboration count is surfaced to ward officers as a priority signal.
🚫 Spam & Bot Controls
🔒
Rate limiting. Authenticated users: 10 reports per hour, 40 per day. Anonymous (guest) mode: 3 per session. Exceeding limits returns HTTP 429 with a Retry-After header.
🔒
Device fingerprinting. Headless browser signatures, emulated GPS coordinates (common with location spoofers), and known VPN exit nodes associated with past abuse are soft-blocked for 7 days.
🔒
Velocity analysis. A burst of ≥ 5 reports from the same device in under 3 minutes triggers an automatic CAPTCHA challenge and queues the account for manual trust-score review.
⚠
Reputation scoring. Each account carries a 0–100 trust score. Reports from accounts below 30 are held in "Under Review" state and not published to the live map until a moderator clears them.
📸 Media Authenticity Review
Photo and video evidence is central to NagarDrishti's credibility. Every uploaded media file passes through the following checks:
✓
EXIF timestamp vs. submission time. If the image was captured more than 72 hours before submission, it is flagged as "Aged Evidence" and may not qualify for SLA timers.
✓
EXIF GPS cross-check. Photo GPS metadata must be within 200 m of the submitted incident pin. Mismatch → "Location Unverified" badge.
✓
AI-generated image detection. We run a binary classifier (C2PA / Content Provenance standard) to detect AI-generated or heavily edited imagery. Flagged images are held pending manual review.
⚠
Screenshot & stock photo detection. Screenshots of maps, WhatsApp forwards, or stock photo matches (reverse-image lookup against a known DB) are rejected with an explanatory error to the submitter.
Note: Passing media checks is not a guarantee of authenticity — it is a signal of plausibility. Ground-truth verification remains the responsibility of the assigned ward officer.
🚧 Abuse Controls & Appeals
Citizens or municipal officers who believe a report was wrongly flagged, suppressed, or attributed can raise an appeal:
🔒
False-positive appeal. Available on the platform within 14 days of suppression. A two-person moderation team reviews within 48 hours.
🔒
Counter-reports. Ward officers may flag a submission as "Invalid / Resolved Prior" — this is recorded against their account and reviewed monthly to prevent misuse of the counter-report tool.
✓
Transparency log. Every moderation action (suppression, merge, rejection) generates a log entry visible to the original submitter. Reasons are disclosed in plain language, not code references.
🔒
Data Privacy & Ethics
What we collect, why, how long we keep it
📋 What Data We Collect & Why
| Data Element | Purpose | Mandatory? |
|---|---|---|
| Incident location (lat/lng) | Pin on map, ward routing, geo-verification | Yes |
| Category + description | Classification, SLA timer, trend analysis | Yes |
| Photo / video evidence | Authenticity, before/after "Proof of Fix" | Optional |
| Device token (hashed) | Spam control, deduplication, rate limiting | Yes |
| Account ID (if signed in) | Audit history, badges, appeal eligibility | Optional |
| Phone / email (registration) | Status notifications, account recovery | Optional |
| Name / identity | Not collected | Never |
| Caste, religion, political affiliation | Not collected | Never |
NagarDrishti operates on a minimum-necessary data principle. If a data point is not required to verify or route a civic report, we do not collect it.
📅 Data Retention Policy
| Data Type | Retention Period | Basis |
|---|---|---|
| Resolved civic incidents (anonymised) | 7 years | Urban local body audit obligations; IT Act 2000 |
| Unresolved / pending incidents | Until resolved + 3 years | Accountability & SLA tracking |
| Media (photos/videos) — resolved | 90 days post-resolution | Proof-of-Fix archive; then deleted or anonymised |
| Raw device tokens | 90 days | Fraud detection; rolling window |
| Account data (active users) | Duration of account + 1 year | Data minimisation practice |
| Account data (deleted accounts) | 30 days post-deletion | Recovery window; then permanently purged |
| Moderation / audit logs | 3 years | Transparency & appeals |
| API access logs | 180 days | Security & abuse detection |
📸 The "Proof of Fix" Lifecycle (Media Archival)
When a citizen submits photographic evidence, the image serves a dual purpose: verifying the problem exists, and eventually verifying the fix was implemented. This is the lifecycle:
✓
Submission (Day 0). Original image ingested. EXIF stripped. Hashed for deduplication. Stored in encrypted object storage (AES-256).
✓
Active period. Compressed thumbnail displayed on public map. Original retained for ward officer review.
✓
Resolution (Ward closes ticket). A "Proof of Fix" photo uploaded by the ward officer is linked to the original. Both images form an immutable before/after pair.
⚠
Day 90 post-resolution. Original citizen photo and ward photo are deleted from live storage. Only a cryptographic hash (SHA-256) is retained as a tamper-evident audit record. The before/after pairing record remains in the database.
🔒
Legal hold exception. If the incident is under active investigation or an RTI request has been filed, the Day 90 deletion is suspended until the legal hold is lifted.
🧹 PII Scrubbing — Protecting the Citizen
When a civic report is published to the public map or the Open Data feed, it is scrubbed of all personally identifiable information:
✓
Coordinates rounded to ward centroid. The precise GPS pin (accurate to ≤ 5 m) is replaced with the ward-level centroid in all public outputs. This prevents inference of a reporter's home or workplace.
✓
Account identity masked. Public-facing records show "Citizen Reporter" or a pseudonymous badge handle. Account ID is never exposed in the API or exports.
✓
Face and licence plate redaction in media. All uploaded images are processed by an automated redaction model to blur faces and vehicle registration plates before public display.
✓
Description free-text scrub. NLP runs on the description field to detect and mask phone numbers, Aadhaar patterns, email addresses, and names before publication.
Scrubbing happens in a write-once pipeline — the original (pre-scrub) version is stored only in the secure internal database and never re-exposed after the scrub pass.
⚖️ Legal & Investigative Holds
NagarDrishti cooperates with lawfully issued orders from Indian courts, law enforcement agencies, and RTI applicants. Our procedure:
⚠
Scope verification. Every request is reviewed by legal counsel to confirm jurisdiction, scope, and the validity of the authorising document. Requests lacking a court order or Section 91 CrPC notice are declined.
🔒
Minimum disclosure. We disclose only the specific records covered by the order. We do not provide bulk exports or speculative data ranges.
🔒
User notification (where legally permissible). If the law does not prohibit it, we inform the affected user that a disclosure was made within 14 days of compliance.
✓
Transparency reporting. We publish an annual aggregated count of legal requests received, contested, and complied with — without identifying specific cases.
🗑️ The Right to be Forgotten (User Autonomy)
NagarDrishti users may request erasure of their personal data at any time.
✓
What gets erased. Account profile, contact information, device token linkage, and any unpublished drafts. Processed within 30 days of a verified request.
⚠
What is retained (anonymised). Civic incidents you submitted remain in the public record — they are already anonymised and have public interest value. Only the link between the report and your identity is severed.
🔒
Legal hold exception. Data subject to an active court order or RTI hold cannot be erased until the hold expires.
✓
How to request. On the web platform: Account Settings → Delete Account & Data. Or email privacy@nagardrishti.in with subject "RTBF Request". We will acknowledge within 48 hours.
The erasure of an account does not reverse any civic impact — resolved incidents, corroboration counts, and badge history are de-linked from your identity but remain part of the city's civic record.
📂
Open Data Policy
What is public, what requires a license, and what is restricted
🌐 What is Publicly Available
NagarDrishti believes civic data about public infrastructure belongs to the public. The following are freely available without authentication:
✓
Ward-level aggregated incident counts by category and severity
✓
City Heartbeat scores (7-day rolling average)
✓
Resolution rates and SLA compliance percentages per city
✓
Category-level 24-hour trend data (anonymised)
All open data is provided under the Government Open Data License – India (GODL-India), consistent with the National Data Sharing and Accessibility Policy (NDSAP).
🔑 Licensed API Access
Researchers, journalists, municipalities, and civic tech developers may apply for API access to incident-level (anonymised) data:
| Tier | Who | Data Depth | Cost |
|---|---|---|---|
| Community | Individual researchers, students, NGOs | Ward-level aggregates, 30-day lag | Free |
| Partner | Municipalities, Smart City SPVs | Real-time, incident-level (ward-anonymised) | MoU / SLA agreement |
| Press | Registered media organisations | Trend data, city rankings, resolution stats | Free (accreditation required) |
🏛️
Compliance & Data Processors
Third-party services that process NagarDrishti data
📋 Regulatory Compliance
NagarDrishti handles citizen data responsibly and in line with India's IT Act 2000. We collect only what is needed to operate the civic audit platform, store it securely on AWS Mumbai (AES-256 at rest, TLS 1.3 in transit), and never sell personal data to third parties.
Open civic datasets — incident locations, category counts, resolution rates — are published under the Government Open Data License (GODL-India) for full public accountability.
For any privacy questions, data requests, or concerns, write to us at privacy@nagardrishti.in — we respond within 48 hours.
🔗 Data Processor Register
NagarDrishti uses the following third-party services to operate the platform. This register is updated within 30 days of any change.
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) — AP-South-1 | Cloud hosting, object storage (S3), CDN (CloudFront), database (RDS) | All incident data, media files, user account data (encrypted at rest, AES-256) | India Mumbai (ap-south-1) |
| Mappls India (MapmyIndia) | Map tile rendering, geocoding, reverse geocoding for ward lookup | Incident coordinates (rounded to ward centroid before transmission) | India Mappls (CE Info Systems, India) |
| MSG91 | SMS OTP for account verification; emergency SLA breach SMS to officers | Registered mobile number (hashed after dispatch); message content | India MSG91 (Walkover Web Solutions, Indore) |
| MSG91 | Transactional email — account verification, status updates, partner access | Email address, notification content | India MSG91 (Walkover Web Solutions, Indore) |
| Google Fonts / CDN | Web font delivery (Plus Jakarta Sans, IBM Plex Mono) | IP address (standard CDN log — 30-day retention by Google) | US / Global CDN edge nodes |
| Leaflet.js / CloudFlare CDN | Interactive map rendering library | No user data transmitted; CDN delivers static JS/CSS only | Global CDN edge (open source) |
| IMD / NRSC API (Government) | Weather alert integration (monsoon/heat triggers); satellite imagery | City-level query parameters only — no personal data shared | India Government of India servers |
| Razorpay | NagarDrishti Member subscription payments (future) | Payment instrument metadata (PCI-DSS compliant); no card data stored by NagarDrishti | India RBI-regulated; data localised |
🟢
System Status
Live platform health and incident history
✅ Current Status — All Systems Operational
| Component | Status | Uptime (30d) | Last Checked |
|---|---|---|---|
| 🗺️ Live Map & Dashboard | Operational | 99.94% | Just now |
| 📤 Civic Report Submission | Operational | 99.91% | Just now |
| 🔔 SLA Alert & Notification Engine | Operational | 99.87% | Just now |
| 🔑 Authentication (Sign In) | Operational | 99.99% | Just now |
| 📡 Open Data API | Operational | 99.82% | Just now |
| 🗄️ Data Storage & Backup | Operational | 100% | Just now |
| 🌐 CDN & Map Tiles | Operational | 99.98% | Just now |
All systems normal. No active incidents or maintenance windows scheduled.
📋 Recent Incident History (Last 90 Days)
| Date | Incident | Duration | Impact | Status |
|---|---|---|---|---|
| 12 Apr 2026 | Map tile CDN degradation — partial outage in North India region | 43 min | Map display only; submissions unaffected | Resolved |
| 28 Mar 2026 | SMS OTP delivery delay — MSG91 gateway congestion | 22 min | Login via OTP delayed; Google Sign-in unaffected | Resolved |
| 15 Feb 2026 | Scheduled maintenance — database index rebuild | 35 min | Read-only mode; no data loss | Resolved |
Post-incident reports (PIRs) for all Severity-1 outages are published within 72 hours. Historical PIRs are available via the Open Data API.
🔧 Planned Maintenance
No maintenance windows are currently scheduled. Planned maintenance is announced at least 48 hours in advance via email notification to registered users and posted here.
Subscribe to status updates: status@nagardrishti.in