Trust is engineered, not declared
A privacy notice is a claim. A consent signal that reaches every downstream system is a control. We are only interested in the second kind, because only the second kind survives a test.
Loading page content
Indian enterprises navigating DPDPA, CERT-In directions, the EU AI Act and ISO 42001 face a choice between global consultancies selling methodology imported from other markets, and local firms selling documentation — a policy set, a gap report, a certificate — with no capacity to make anything work in a live system.
Neither answers the question that actually matters, which is not “what does the regulation say?” but “what do we change on Monday, in what order, and who does it?”
We built this practice around that question. Every consultant has operated in the role they now advise on. Our architects have run production estates; our DPOs have held statutory appointments; our compliance lead spent years auditing management systems from the certification body side of the table. The person in your first meeting is the person doing the work.
We are a new practice, launching in 2026. What is not new is the people in it, or the discipline we hold ourselves to: test the control, report what the test found, and stay through the audit.
Brand promise
Building Digital Trust for the AI Era
Trust is not a claim you make in a privacy notice. It is a property of systems that behave the way you said they would — verifiably, under test, in front of a regulator or an enterprise buyer who has no reason to believe you.
These are not values on a wall. Each one costs us something — revenue, speed or comfort — which is how you can tell they are real.
A privacy notice is a claim. A consent signal that reaches every downstream system is a control. We are only interested in the second kind, because only the second kind survives a test.
Most programme overruns trace back to a scope that was never really agreed. We settle it in week one, in writing, with the trade-offs made explicit.
A control regime applied uniformly to everything will be routed around within a quarter. Tier by consequence, and spend the scrutiny where it changes an outcome.
If doing the right thing is slower than doing the expedient thing, people will do the expedient thing. Design the paved road before you build the fence.
Specific, checkable claims — including the revenue we refuse and why.
We hold no reseller agreements, referral fees or vendor commissions of any kind. When we recommend a platform — or recommend that you do not need one — there is nothing behind the advice but the analysis.
No vendor revenue, by policy
Every consultant has operated in the role they now advise on. Our architects have run production estates; our DPOs have held statutory appointments. The person in your first meeting is the person doing the work.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Clients pay us for judgement, and judgement that arrives after the decision is worthless. If the timeline is unachievable or the architecture is wrong, we say so in week two.
Dependence is easy to create and easy to monetise. We design every engagement against one test: whether the third governance cycle runs cleanly with us out of the room.
No pyramid staffing model
We do not report a control as effective because a policy describes it. We test consent propagation, restore from backups, attempt the privilege escalation. Findings are what the test showed.
Evidence-based findings only
Our unified library cross-maps over 400 controls across DPDPA, ISO 27001, ISO 27701, ISO 42001, SOC 2, NIST CSF and PCI DSS — so a control implemented once satisfies every obligation it touches.
One control, many frameworks
DPDPA is not GDPR with different names, and CERT-In's six-hour clock has no international equivalent. We build for the obligations that actually apply here, then map outward to global frameworks.
India-first, globally mapped
Our engagement model does not end at document handover. We run the internal audit, sit in the certification audit, and close the nonconformities. Accountability that ends before the exam is not accountability.
Present at every audit, by design
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.