DPDP Data Inventory

    A RoPA and DPDP Act compliance platform built for India’s Digital Personal Data Protection Act — not a relabeled GDPR tool. Government transfer restrictions, guardian consent, and legitimate-use tracking, backed by a database-enforced audit trail.

    • Normalized RoPA engine with approval history
    • One-click XLSX / PDF export, audit-logged
    • DPDP-specific: transfer restrictions, guardian consent, legitimate use

    Free trial available — no credit card required.

    Platform facts

    DB-enforced RLS across 35+ tables

    Tenant isolation

    One-click XLSX / PDF, audit-logged

    RoPA export

    Recorded in a filterable audit trail

    Every mutation

    Why spreadsheets and generic tools fall short

    RoPA lives in a spreadsheet

    Processing activities, categories, and systems drift out of sync the moment two people edit the same sheet. There is no approval state, no history, and no way to tell what changed.

    Generic GDPR tools miss DPDP specifics

    Government transfer restrictions, guardian consent for children and persons with disabilities, and the DPDP Act’s legitimate-use clauses have no equivalent in most GDPR-first tooling.

    No audit trail when a regulator asks

    When a notice or consent record changes, most teams cannot say who changed it, when, or what the record looked like before.

    Built for the DPDP Act, module by module

    Each module below is tied to the part of the Act it addresses.

    RoPA Engine

    Records of Processing Activities

    Processing activities are normalized against categories, subjects, processors, and systems — not free text. Soft delete preserves history, and an approved or archived activity automatically reverts to draft when a material change matches a configured reapproval rule. Every mutation is written to the audit log in the same transaction.

    One-Click RoPA Export

    GET /ropa/new/export

    Export your full RoPA as XLSX or PDF in one click. Each export fires its own audit entry, so there is a record of who pulled a copy and when.

    Government Transfer Restrictions

    DPDP Act §16(1) / Rule 15

    A matching engine cross-references your processors, recipients, systems, and data transfers/flows against government-notified restricted countries — flagging transfers that need a closer look before they become a compliance gap.

    Guardian Consent Mechanisms

    DPDP Act §9(1) / Rules 10–11

    Verifiable consent workflows for children and persons with disabilities, covering DigitalLocker / authorised-entity verification, voluntary identity tokens, court-appointed guardianship, and local-level-committee guardianship.

    Legitimate Use Clauses

    DPDP Act §7

    Track processing that relies on a legitimate-use ground — voluntary disclosure, employment, medical emergency, state functions, and the other statutory categories — alongside your consent-based activities.

    Data Flows Diagram

    Visual system-to-system mapping

    See how data actually moves between systems, processors, and recipients in a generated visual diagram, kept in sync with your RoPA records rather than maintained by hand in a separate tool.

    DSR Workflow

    Data Principal requests

    Log, assign, and track data-principal requests through to resolution, with the same audit trail and RLS isolation as the rest of the platform.

    Who it’s for

    Founders & CTOs

    Get a defensible, current RoPA without a spreadsheet nobody trusts — and an export you can hand to counsel or an investor’s diligence team on request.

    Legal & DPO teams

    Work the DPDP-specific mechanics — transfer restrictions, guardian consent, legitimate-use grounds — directly against your organization’s actual processing activities, with a full change history behind every record.

    Consultants & agencies

    Each client gets an isolated, RLS-secured workspace, provisioned for them by our platform team. This is not a self-service multi-tenant switcher — workspace setup is handled by us on request, per client.

    How it works

    1

    Workspace provisioned

    Our platform team sets up an isolated workspace for your organization (or your client, if you’re a consultant).

    2

    Build or import your RoPA

    Enter processing activities directly, or bring in an existing register via Excel import.

    3

    Run DPDP-specific checks

    Review transfer-restriction flags, guardian-consent requirements, and legitimate-use classifications against your activities.

    4

    Export & audit

    Pull a one-click XLSX or PDF export whenever you need one, backed by a full, filterable audit trail.

    Security & isolation

    Database-enforced tenant isolation

    PostgreSQL FORCE ROW LEVEL SECURITY on every tenant table, keyed to a per-transaction session variable, verified with an isolation matrix across 35+ tables. This is a database-level boundary, not just an application-layer filter.

    Full audit trail

    A filterable, per-tenant audit log — by date range, entity type, action, and actor — covering roughly 30 tracked entity types, with CSV export.

    MFA (TOTP)

    Optional time-based one-time-password multi-factor authentication on top of email and password login. We do not currently offer SSO.

    Metadata-only processing

    The platform works with definitions and metadata about your processing activities — it does not ingest your raw customer records.

    Frequently asked questions

    Is this a self-serve signup?⌄

    Not yet. Workspaces are provisioned by our platform team on request — there’s no instant self-service signup or dashboard redirect today. Submit the form above and we’ll set your workspace up.

    Do you support SSO?⌄

    Not yet. Authentication today is email and password, with optional TOTP-based MFA.

    Do you compute a maturity or compliance score?⌄

    No. We don’t generate an automated or personalized maturity score — the platform gives you the underlying RoPA, transfer, consent, and audit data so you (or your counsel) can make that assessment.

    What does isolation between clients/tenants actually mean?⌄

    Every tenant table has PostgreSQL row-level security enforced at the database level, keyed to the current tenant on every transaction — not just filtered in application code.

    What does pricing look like?⌄

    A free trial is available, no credit card required. Talk to us for workspace and pricing details for your organization.

    Do you integrate with our CRM or send webhooks?⌄

    Not currently. There is no CRM or webhook integration in the platform today.

    Get your DPDP-ready RoPA in place

    Free trial available — no credit card required.