Seven red lines, eight commitments and a few rules of language. They are product requirements, not marketing. A feature that breaks one of them does not ship.
Source of record: docs/company/DOCTRINE.md in our repository. Changes are reviewed like code. The doctrine text below is quoted in full; the "In practice" notes are ours.
Where a note below names a Sakshi rule (RL-1, TP-1), the rule is written in our access policy and tested; wiring it into every product is in build. The policy is published at Trust and security.
We analyse incidents, seizures, places, routes, conditions, and organisations. We do not build profiles, dossiers, or risk scores of individual people.
Nothing we build selects, scores, or filters people by religion, caste, ethnicity, language, or nationality of origin.
RL-4) rejects filters and free-text requests that select by religion, caste, ethnicity, language, surname or origin, and records each refusal.Names of private persons that appear in public records (accused, petitioners, witnesses, victims) are replaced with role labels in every analytic view. Public officials acting in an official capacity may be named, never scored.
RL-1). There is no override.RL-2), and searching them needs a second approver (TP-1).We do not ingest private messaging groups, intercepted communications, or scraped personal social-media accounts.
We do not build tools that rank, prioritise, or predict outcomes for people facing Foreigners Tribunals, NRC processes, or deportation.
Counter-drone and sensor products detect, track, classify, alert, and support lawful, non-kinetic responses. We do not publish weapon-targeting guidance.
Any forecast or advisory that can affect a life (flood, heat, sea state, river crossing) states its source, its time, its uncertainty, and that it is advisory.
Real data cites its origin and retrieval time. Simulated data is labelled Simulated in the UI and "simulated": true in JSON.
Operator actions are written to a hash-chained audit log that anyone with access can verify (Sakshi).
Sensitive queries carry a declared purpose; policy decides what each purpose may see.
Data has a retention period; expiry is enforced, not promised.
Software recommends; trained people decide. No automated adverse action against any person.
TP-1, TP-2). Approvals are single-use and expire after 24 hours.Products run on-premise or air-gapped on Indian soil; no foreign cloud dependency is required for operation.
Where the same capability protects civilians (flood warning, heat advisories, fishermen's boundary awareness), we publish a free public version.
Each product ships a methods note: data, assumptions, limits, known failure modes.
Surveillance tools fail people quietly. In September 2026 the Internet Freedom Foundation reported that Delhi Police's facial recognition flagged 2,873 people at protests at Jantar Mantar, using an 80% match threshold, against a database with no disclosed statutory basis or retention limit. An Indian Express check cited by IFF found at least 25 of 205 sampled people were in jail when the software placed them at the protest (IFF, 4 Sep 2026).
Citizenship cases are where errors cost most. In July 2026 the Supreme Court set aside a batch of ex parte Foreigners Tribunal opinions, holding that the burden of proof "does not convert the absence of the proceedee into proof of the allegation" (Sabitri Dey v. Union of India, 13 Jul 2026). Software that ranks such cases would add speed to a process the courts are asking to slow down and check.
The legal test is already set. Any intrusion on privacy must pass legality, a legitimate aim, proportionality and procedural safeguards (Puttaswamy, 2017). Purpose binding, two-person approval and the audit chain are how our software helps a user show the last two.
If you see Trinetra software, data or staff crossing one of these lines, write to oversight@trinetra.in. You do not need to give your name. We reply within five working days and publish a summary of every concern and what we did about it in our transparency report.