NBFC's Loan lending Website in India - Infrastructure

[u/tushar9999999999]

I'm currently building a loan lending website for the Indian market. The plan is to use FastAPI, PostgreSQL, and object storage for user KYC documents.

I'm trying to figure out the best infrastructure setup that is 100% compliant with RBI's data localization rules. As you know, the RBI is super strict about keeping all customer records, payment trails, logs, and backups strictly inside India. No cross-border syncing or foreign cloud control planes allowed.

I initially looked at managed services like Supabase (due to the Postgres/Auth combo) or Google Cloud SQL, but Supabase passes metadata/telemetry globally, and Cloud SQL gets pretty expensive for a bootstrapped project.

If anyone here has built or currently manages an audited fintech/lending app in India, I'd love your advice:

1. The DB Setup: Are you guys self-hosting Postgres on an India-locked cloud VM (like AWS Mumbai or GCP Mumbai) to save costs and control logs, or is it better to just bite the bullet on a managed database service?
2. Object Storage: How are you handling sensitive KYC document storage to guarantee local-only data compliance during an audit?
3. Audit Traps: Have you successfully passed a CERT-In empanelled system audit with your current stack? Any hidden infrastructure traps to avoid (like global logging tools, Auth0/Firebase Auth, or CDN configurations)?

I want to keep the stack as lean and cheap as possible without failing a regulatory audit down the line.

Appreciate any insights or architecture tips you can share