Compliance readiness audit
Audit-ready for CERT‑In, DPDP and your next security review
For SaaS, fintech and IT companies in India, and teams serving Indian customers. We check your systems and website with our own tools, help you fix what we find, and hand you the evidence. Fixed scope and fixed price, agreed before we start.
What's covered
Pick the areas you need
Most companies start with the one an auditor or customer is asking about, then add the rest.
CERT-In Directions
Log retention and location for every ICT system, clock synchronisation, a Point of Contact, and a 6-hour incident reporting runbook.
How it's checked →Checked with PrivacyPilotDPDP Act
Website forms, trackers and cookies, the privacy notice, consent and withdrawal, grievance handling and a data inventory.
How it's checked →Checked with VendorPassportBuyer security reviews
Security headers, TLS, SPF, DKIM and DMARC, access reviews, leaver offboarding and a shareable security profile.
How it's checked →Checked with ResidencyMapData residency
Which country every database, bucket, replica and backup is in, and which transfers need action.
How it's checked →Checked with SBOMReadySoftware supply chain
An SBOM with CERT-In's 21 fields, leaked secrets in code and history, and AI agents with access to your repositories.
How it's checked →Checked with BreachClockIncident readiness
Every notification deadline for India, the EU, UK, US and Australia, with notices drafted in advance.
How it's checked →Readiness audit
How the audit works
- 1Scope
A 30-minute call to agree what's covered: which rules, systems and website. You get a fixed scope and a fixed price before we start.
- 2Check
We run our tools in your environment, read-only: cloud accounts, Terraform, CI, code and website. Nothing leaves your infrastructure that you haven't approved.
- 3Fix
You get every gap ranked by risk, with the evidence and the exact fix. Your team fixes them, or ours does it with you.
- 4Prove
A final re-check and an evidence pack: reports, configuration proofs, runbooks and policies, ready for your auditor, bank or government buyer.
What you get
Deliverables
- A readiness report: every gap ranked by risk, each with the evidence it came from and the fix.
- Fix support: configuration, code and policy changes, made by your team with our guidance, or by our engineers.
- A re-check after the fixes, so the report shows what's closed.
- An evidence pack: reports, configuration proofs, an incident runbook, a log register and policy drafts.
- The tools themselves, if you want to keep checking in your own CI.
FAQ
Questions
How long does it take?
It depends on the scope and how quickly fixes are made. We agree a timeline with the scope, before we start.
How is it priced?
A fixed price for an agreed scope, quoted after the scoping call. No hourly billing surprises.
Do you need access to our systems?
Read-only access, or we run the tools with your team on your machines. Nothing leaves your infrastructure that you haven't approved.
Is this a certification?
No. It gets you ready for the audit, review or tender you face, with evidence. Certification, where one exists, comes from the auditor or authority.
Is this legal advice?
No. We check technical and website controls against the published rules. For legal interpretation, work with your lawyer; we'll give them the evidence.
Can we start with just one area?
Yes. Most companies start with the review in front of them, such as a bank questionnaire or a CERT-In audit, and add other areas later.
Tell us what you're being asked for
A 30-minute call. Bring the questionnaire, the tender clause or the audit request, and we'll tell you what it takes.