No reseller agreements
We do not resell software, hardware or managed services. There is no margin behind any tool we recommend, and no tier we are trying to maintain.
Loading page content
From founding in 2026 onward, DATATrust India will take no revenue from reseller margin, referral fees or vendor commissions of any kind. Every rupee is to come from clients paying for advice.
Each one is common in this industry and each one would compromise the advice. Declining them costs us revenue, which is precisely why they are worth publishing.
We do not resell software, hardware or managed services. There is no margin behind any tool we recommend, and no tier we are trying to maintain.
We accept no commission for introducing a client to a vendor, certification body, law firm or assessor. Introductions are made on fit, and we say so in writing.
Certification and attestation must come from independent parties. Legal opinion must come from counsel. Testing must come from someone who did not design the controls. Our job is to run the client's side of each of those relationships.
We work alongside accredited certification bodies across ISO 27001, ISO 27701 and ISO 42001 audits. We do not certify — independence rules prohibit the implementer from auditing — so we help clients select and manage a body suited to their sector and geography.
All four operate without money moving between us and the referring party — the engagement is always directly between DATATrust India and the client.
Consulting firms and system integrators engage us for specialist privacy, AI governance and certification capability on their own client programmes, under their brand or ours.
Typically: Consultancies, system integrators, technology implementation partners
We do not penetration test the controls we designed, and we do not certify the management systems we implemented. A test performed by the designer is a marketing exercise.
Contracts with certification bodies, assessors and vendors are between the client and that party. We never sit in the middle of a commercial relationship we advise on.
SOC 2 examinations must be performed by a licensed CPA firm. We maintain working relationships with several across the United States and India, and help clients choose based on sector familiarity and fieldwork approach rather than price alone.
For PCI DSS engagements requiring a Report on Compliance, we prepare clients and coordinate with QSA firms through scoping, evidence review and fieldwork — remaining on the client side of the table throughout.
Where an engagement requires legal opinion — regulatory interpretation, cross-border transfer analysis, contractual dispute or a regulator interaction — we work with specialist data protection counsel in India, the EU and the US. We advise on operations; they advise on law.
Our engineers hold current certifications across AWS, Microsoft Azure and Google Cloud, and we work with provider security teams on landing zone and architecture reviews for client estates. We hold no partner-tier revenue arrangements with any of them.
We implement and operate whichever platform a client has chosen — OneTrust, Securiti, Vanta, Drata, Sprinto, ServiceNow IRM and others. We take no commission from any of them, which is why we will also tell you when you do not need one.
Penetration testing and red teaming are commissioned from independent specialists rather than performed by the team that designed the controls. Separating design from testing is the only way the test result means anything.
We collaborate with Indian academic institutions on AI evaluation methodology and privacy engineering research, and contribute practitioner input to standards development. Research outputs are published openly through our Knowledge Hub.
Law firms and accountancy practices refer clients needing operational delivery behind their legal advice. The engagement is direct between us and the client, with no fee flowing either way.
Typically: Law firms, accountancy practices, corporate advisory
GRC and privacy platform vendors engage us to deliver implementations for their customers. We remain the customer's advisor, including on whether the platform is the right answer.
Typically: GRC platforms, privacy technology vendors
We contribute to industry associations, standards work and sector working groups on privacy, security and AI governance — usually as unpaid practitioner input.
Typically: Industry bodies, standards organisations, regulators
Interested in a delivery partnership?
We take on specialist privacy, AI governance and certification work behind consultancies and system integrators, under your brand or ours. Write to us with the shape of the requirement.