Aadhaar (UIDAI) 6
KYC & Onboarding 3
Digital Signatures 2
Data Privacy (DPDP) 2
MOSIP (National ID) 1
Products
DPDP Act, 2023 · DPDP Rules, 2025
Notices, consent, rights requests, breaches and the records the Data Protection Board will ask for, in one platform built for India and run on your own infrastructure.
Notices & consent §5 · §6 · §9
Every consent is bound to the exact notice and wording the person saw, with a proof token and a signed receipt.
Notices and consent texts are versioned. A different person approves before anything is shown to a customer, and only an approved version can be.
English and all 22 Eighth Schedule languages. Rule 3's sections on withdrawal, rights, grievances and the Board start filled in on every new draft.
Recorded per purpose, never per organisation: the version, the time, a proof token and a signed receipt.
One step for the person. Approved processors are told by a signed event within seconds, with a record both sides keep.
Bring in pre-Act consents with their true dates and original wording, from CSV or Excel, and track every notice still owed.
Refused until the parent is verified: against your own records, DigiLocker, an identity token, or an Aadhaar OTP through your own AUA/KUA.
How consent works
The author writes the wording; the DPO approves it.
Your site or app shows the notice, and the consent is recorded against that exact version.
The person withdraws in one step, and your processors hear of it at once.
Two years from now, this is what answers the Board.
People & rights §11–§14 · Rule 14
Access, correction, erasure, grievances and nomination: numbered, clocked and answered, with one report of everything you hold about a person.
Every request is numbered and clocked from the day it arrives, against the response period you publish.
The person's profile, consents, the notices served and their past requests, in one export attached to the request.
A plan, an erasure the DPO executes, a live rescan and a signed certificate. Whatever law requires you to keep is named, with the date it falls due.
Your own address and QR code for every form and branch poster. A person signs in with a one-time code and sees only your records.
Nominees on record; invoking one is re-authenticated and evidenced, so it never happens by accident.
A published Grievance Officer answers grievances; refusing one stays the DPO's decision.
The person's own portal
Incidents §8(6) · Rule 7
Report an incident and every deadline starts at once, with the filings written for you.
The Board has not yet published a filing portal. The platform prepares each filing, runs its clock and records the reference your DPO submits; the day an electronic channel exists, it files through it.
The intimation and the 72-hour report as PDFs with their SHA-256 on every page; the Board's acknowledgement is stored with the filing.
Upload the list your security team gives you. Each person's notice is queued the moment they are added.
Drills run the real chain on a labelled incident that never reaches a regulator, and score it against the clocks.
Prove it §8(1) · §10 · Rule 6
Checks every night against your own records, statutory registers from live data, and an audit trail nobody can edit.
Overdue requests, unsent filings, lapsed guardian verifications, notices missing Rule 3 sections: found every night, with a date to fix them.
Erasure, grievance, breach, impact assessment, transfer, processor, legal hold and more, with incomplete or contradictory rows flagged.
171 kinds of action recorded and verified every night. No one can edit or delete a line, the administrator included.
Each sign-off is signed in your key store when the DPO decides. Your auditor checks it with openssl, without us.
Compliance status, rights, breaches, processors and more: figures from the records, words from the DPO, issued once.
Every letter with its date for an answer, and every voluntary undertaking with each term tracked to the day.
Seven roles, one platform
Security & deployment §8(5) · Rule 6
Your own infrastructure or an Indian cloud. Each organisation in its own schema, with its own key, held in your HSM.
Personal data encrypted field by field, with keys made and used inside your HSM and rotated on a schedule. A conformance check proves the device on your own slot.
No shared logins and no exemptions. Single sign-on through your identity provider still asks for the authenticator.
Every sign-in, refusal and lockout, kept for a year and forwarded to your own SIEM.
One organisation's data never meets another's, and the platform's administrator cannot read it.
About 800 REST endpoints, a consent SDK for web, Android and iOS, 24 signed event types, and connectors for CSV, Excel, databases and REST.
Nightly backup sets with an encrypted copy off the box, and scheduled jobs that never run twice across servers.
Getting ready
Readiness is measured on the platform from your own data, so progress is visible at every step.
A readiness baseline; the DPO, notices, purposes and retention set up.
Connect through the API, SDK and connectors; bring in existing consents with their true dates.
Run a breach drill against the clocks and reach Go-Live Readiness, 14 of 14.
Nightly checks, live registers and signed DPO reports: evidence, every day.
The platform shown on your own use cases, and your readiness measured against the Act.