Trust, Security & Compliance

How a business looks after other people's data, and proves it. That includes knowing what personal data you hold, asking for consent properly, giving people a way to use their rights, protecting systems from common attacks and being able to show an auditor or a large customer what you do.

Many businesses keep this in a policy folder. We build it into the website, the app and the cloud account instead, so the safeguards run every day and the records build themselves.

Businesses that collect personal data from customers, students, patients, members or job applicants, including those covered by India's Digital Personal Data Protection Act. Companies whose customers now ask for ISO 27001 or SOC 2 evidence. Startups preparing for an audit, a fundraise or a listing. And teams whose products are used by children, where extra care applies.

If you are unsure where you stand, the DPDP Readiness Scan is a good first step. It looks at personal data, consent and notices, and ends with the top fixes in a short written report.

TechSum implements: data mapping, consent and cookie systems, request workflows, retention rules, access controls, safe storage of passwords and keys (secrets management) and collecting the evidence.

Partner counsel advises on legal interpretation, such as how the Digital Personal Data Protection Act, 2023 applies to your case.

Accredited certification bodies issue certificates, independent auditors issue SOC 2 reports, and accredited testing partners deliver formal penetration test reports. We coordinate these and prepare you for them.

• DPDP Act readiness assessment and data mapping. See DPDP Act compliance.
• Consent, notice and cookie management, with every choice recorded.
• Workflows for access, correction, erasure and grievance requests.
• Retention and deletion automation.
• Children's data handling and verifiable parental consent.
• Breach readiness and incident response, covering DPDP and CERT-In reporting. CERT-In is India's national computer emergency response team.
• Security hardening, secrets management, MFA and SSO. MFA means signing in with a second step, such as a code on your phone. SSO means one sign-in for all your work tools.
• VAPT coordination and fixes, with testing partners. VAPT means vulnerability assessment and penetration testing: security specialists look for weaknesses and try to break in.
• ISO 27001 and SOC 2 readiness, with audit partners. See ISO 27001 and SOC 2 readiness.
• Audit, fundraise and IPO technology readiness, and vendor and processor reviews.
• Compliance Care: ongoing reviews and request handling.

Security is never a separate project. It lives in your servers, backups and email, which sit under Digital Infrastructure, and in your tracking, which sits under Data & Analytics for consent-aware measurement. Because one team builds and looks after all of it, the safeguards go where the risk actually is.

We follow The Path. Listen maps the data, systems and suppliers. Shape sets priorities: what must be fixed first, what can wait, what needs counsel. Build puts the fixes in place in short sprints, collecting evidence as we go. Launch checks the safeguards work and hands over the documents and step-by-step guides. Evolve is Compliance Care: reviews, requests and updates as the business changes.

The TechSum Standard applies throughout:

• Secure by default: access control, second-step sign-in and safe storage of passwords and keys come first, because most incidents start with a simple gap.
• Built to scale: safeguards live in the systems themselves, so new staff, tools and data follow the same rules without a fresh project.
• Tested before it ships: every control is checked before handover. Consent is stored, requests are tracked, and a restore actually restores.
• Looked after after launch: reviews, data requests and updates carry on as the business and the rules change, with every action logged.
• Small changes handled, not invoiced: a notice that needs a new line, or a leaver whose access must go, gets handled. It does not become an invoice.
• Honest advice, even when it means less work for us: if your gaps are small, we say so instead of selling a large programme.

You can list the personal data you hold, why you hold it and when it is deleted. A visitor can accept or refuse non-essential cookies, and the choice is stored. A person can ask for their data and you can answer on time. Staff sign in with a second step. When a large customer sends a questionnaire, the evidence already exists. When something goes wrong, there is a written plan and people know their part.

If you want a certificate without doing the work behind it, we are not the team. If you need a legal opinion, you need counsel, and we will introduce our partners. And if your gaps are small, we will say so rather than sell you a large programme.

To start, tell us what you need.