Audit-ready from day one. Not a scramble later.
Certification is issued by an accredited body. Our work is the technical half that makes that audit a formality: controls implemented in the system, evidence collected automatically, and drift prevented rather than discovered next quarter.
- Readiness for
- ISO 27001 · SOC 2 · DPDP Act 2023
- Approach
- Gap assessment → controls as code → automated evidence → audit support
- Policy engine
- Open Policy Agent, in the build and at runtime
- What we do not do
- Issue certificates or promise an audit outcome
What sits behind the claim
Compliance built into the platform, rather than described in a binder that is only true on audit day.
- Gap assessment. Your current controls mapped against the framework you are pursuing, with each gap written as an implementable technical change rather than a policy aspiration.
- Technical controls in the system. Access control, encryption in transit and at rest, logging and retention, backup and tested restore, and change management — built in, not written up.
- Controls as code. Rules such as "no storage bucket may be public" written as OPA policy that fails the build, and run against Terraform plans and inside Kubernetes admission.
- Evidence that collects itself. Access reviews, change approvals, scan results and deployment records retained by the pipeline as they happen, so an evidence request becomes a query.
- Data residency and mapping. Where personal data lives, who can reach it, how long it is kept, and how a deletion request is honoured end to end.
- Audit-ready documents. The written control set an auditor expects, drafted to describe the system you actually run — plus decision records and runbooks written as the work happens.
How it works in an engagement
We work in the order an auditor will.
Scope, map, assess, remediate
We scope the system boundary, map the data, assess the gaps, then remediate highest-risk first. Technical controls are implemented as code alongside the DevOps work, which is why compliance costs materially less when it shares a team with delivery.
DPDP Act readiness
India's Digital Personal Data Protection Act 2023 applies to anyone processing personal data of individuals in India. In practice: knowing what you collect and why, recording consent, honouring correction and erasure requests, meeting breach-notification timelines, and being able to show all of it.
Governance by design
Maker-checker approval, audit trails and role separation are decisions taken at the data-model stage. Niyantā was built that way, with maker-checker governance on financial approvals and automated audit trails throughout.
Standing behind the evidence
We prepare the evidence set, map each control to the artefact that demonstrates it, rehearse the questions, and sit in the audit with you to answer the technical ones. We do not perform the assessment, and we do not promise an outcome that is the assessor's to decide.
Controls enforced by the pipeline cannot silently lapse between audits.
For teams selling into enterprise or government procurement, that readiness is often the gate on the deal. To be plain about our record: Niyantā was control and evidence work, not a certification engagement, and we have not yet taken a client through an ISO 27001 or SOC 2 audit. The full scope is on the Compliance page.
Questions we are asked
Do you certify our organisation?
No. Certification is issued by an accredited external body, and no consultancy can grant it or promise its outcome. We implement the technical controls, map them to the framework, automate the evidence and prepare your team, so the assessment finds a system that already works the way it is described.
Which frameworks do you cover?
ISO 27001, SOC 2 and India's DPDP Act 2023 are the three most requested, and GDPR readiness reuses the same data mapping, residency and retention work. HIPAA and PCI DSS are outside our current track record, and we will say so rather than take that engagement on.
What does compliance automation mean in practice?
Controls written as executable policy — OPA rules that fail a non-compliant change at build time — and evidence retained by the pipeline rather than assembled by hand before an assessment.
How does DPDP Act readiness differ from GDPR?
The obligations rhyme but the specifics do not: DPDP has its own consent, notice and breach-notification requirements, and data residency expectations that matter to enterprise and public-sector buyers. The engineering underneath — knowing where personal data lives, enforcing retention, deleting on request — is shared.