Privacy & compliance
DPDP compliance operations built into daily IT work
Handle data-subject requests, keep a breach register and consent records, and support per-organization crypto-erasure with annual key rotation — privacy operations built in.
Backed by app modules
- Requests
- Data-subject request handling
- Breaches
- Breach register and consent records
- Erasure
- Per-organization crypto-erasure
- Keys
- Annual key rotation
Built around real workflows
Highlights below describe capabilities already present in the protected app behind this page.
How it works
Log a data-subject request
Record access, correction, erasure or portability requests against the tenant. Each request opens with a status and an SLA due date (30 days by default) and is flagged the moment it breaches.
Work the request to closure
Move a request through pending, in-progress and completed (or rejected), keeping requester notes and internal handling notes separate on the same record.
Keep a breach register
Open a security-incident record with a severity and the affected organizations. Each incident carries a 72-hour authority-notification clock so the deadline is tracked, not remembered.
Capture consent evidence
Consent records store which document (terms or privacy policy), which version, the IP address and the timestamp, giving a defensible history of what each person accepted.
Erase on offboarding
When a tenant is offboarded, erasure is scheduled after a grace window (90 days by default). Final erasure clears the wrapped per-tenant encryption key before the cascade delete, so the data cannot be reconstructed from backups.
Already live in the product
Running in production today: data-subject request handling, consent logging, and crypto-erasure. Protected app route: /compliance
A worked example
Say an NBFC winds down a partnership and the partner's data-protection officer asks for full deletion. The team logs an erasure data-subject request, which stamps a 30-day SLA and starts the clock; handling notes record each verification step. On approval the organization is scheduled for crypto-erasure with a 90-day grace window in case the decision is reversed. When the window lapses, the job clears the tenant's wrapped encryption key before the cascade delete — so even a database dump taken months earlier now holds only ciphertext nobody can unwrap.
What teams can do here
- Step 1
- Log a data-subject request
- Step 2
- Track to fulfilment
- Step 3
- Record consent and breaches
- Step 4
- Erase on offboarding
Frequently asked questions
See also: Access control & conditional access · Security Trust Center · Infronest privacy policy · Blog: VAPT certification explained · Blog: What is endpoint security?
Access control, SSO, and conditional access for every workspace
Learn more
Data loss prevention that closes USB, print and browser-upload leaks
Learn more
Device activity monitoring that starts only after consent is approved
Learn more
Security and VAPT for IT teams
Learn more
Reports, analytics, notifications, and automation rules
Learn moreTurn privacy obligations into tracked workflows
Data-subject requests with 30-day SLAs, a breach register with a 72-hour clock, consent evidence and crypto-erasure — operational records you can put in front of a DPO, not promises.
