Compliance, honestly.
Where we are, what is in progress, and what you are responsible for. We clearly label audit statuses rather than hiding behind ambiguous badges.
Statutory & Industry Framework Alignment
Self-assessed alignment details and honest third-party audit states.
| Framework | Status Badge | What It Means For You | Details / Evidence |
|---|---|---|---|
India DPDP Act (2023)Privacy & Law | Self-Assessed {{OWNER_TO_CONFIRM}} | Indian businesses collecting phone numbers and personal data are designated Data Fiduciaries; DigAI operates as Data Processor. We provide consent logging, purpose-based contact fields, and contact deletion tools. | Privacyplain companion available → |
GDPR (EU & UK)Privacy & Law | Contractual DPA {{OWNER_TO_CONFIRM}} | For clients serving European residents, we offer our standard Data Processing Addendum (DPA), purpose limitation, and single-click contact deletion. Primary hosting is in India {{CONFIRM}}. | Review DPA → |
SOC 2 Type IISecurity Audits | Planned on Roadmap {{OWNER_TO_CONFIRM}} | We do not currently possess a third-party SOC 2 audit report. Security is enforced through automated CI isolation tests, backend permissions guards, and encrypted sessions. | View Security Architecture → |
ISO / IEC 27001Security Audits | Not Certified {{OWNER_TO_CONFIRM}} | We do not hold an ISO 27001 accreditation. If your enterprise policy mandates a certified ISMS certificate, contact our security desk for our security questionnaire. | Request Security Review → |
PCI-DSS (Payment Cards)Security Audits | Razorpay Level 1 Certified | DigAI never collects, processes, or stores cardholder numbers, CVVs, or OTPs. All payment transactions execute inside Razorpay’s PCI-DSS Level 1 certified environment. | Razorpay Security Details |
WhatsApp Business Messaging PolicyChannel Regulations | Enforced in Product | Business-initiated marketing, utility, and authentication messages require pre-approved Meta message templates. Accounts are subject to Meta phone number tier limits and quality ratings. | WhatsApp Integration Details → |
TRAI / DLT SMS Guidelines (India)Channel Regulations | Planned with SMS Gateway | DLT template registration and sender ID headers will apply to native transactional SMS broadcasts when the SMS gateway feature launches. | Track on Roadmap → |
Email Rules & Unsubscribe HeadersChannel Regulations | Cryptographic Tokens Built-in | All outgoing bulk marketing emails automatically embed compliant List-Unsubscribe headers and HMAC-signed unsubscribe links to comply with Gmail and Yahoo 2024 bulk sender standards. | Email Marketing Feature → |
Messaging Compliance Guide
WhatsApp and Indian telecom regulations require strict operational discipline. Here is how DigAI protects your deliverability:
Verified WhatsApp Opt-Ins
You must obtain explicit customer consent before sending business-initiated notifications on WhatsApp.
Meta Template Categorization
Templates are classified as Marketing, Utility, or Authentication with separate per-conversation pricing.
Phone Number Quality Tiering
Meta limits outbound recipients per 24-hour window based on spam reports and user blocks (Tier 1: 1K → Tier 2: 10K → Tier 3: 100K).
Instant Opt-Out & Consent Flags
Recipients must be able to unsubscribe from automated campaigns at any time.
Quiet Hours Protocol (India TRAI)
Promotional communications should respect natural rest hours to prevent brand fatigue and spam complaints.
Data Subject Requests & Contact Erasure
How to fulfill your customers’ rights to access, export, or erase their information under DPDP and GDPR.
Right to Access & Data Portability
Export complete contact profiles, custom attributes, deal histories, and communication logs in standard JSON or CSV format.
Right to Erasure (Deletion)
Permanently remove a customer contact record and all associated message history across campaigns.
Right to Object & Restrict Processing
Flag a contact as opted-out without deleting past billing and tax invoices required by accounting laws.
Compliance & External Audit Roadmap
Formal DPA & Self-Assessment Hardening
Finalize standard contractual DPA documentation and publish detailed DPDP Act compliance guides for Indian SME fiduciaries.
Third-Party Network Penetration Testing
Engage accredited external security testing firms to execute grey-box penetration testing and vulnerability assessments.
SOC 2 Type I Readiness Review
Formalize internal security monitoring evidence collection for independent SOC 2 Trust Services Criteria audit.
Frequently Asked Compliance Questions
Under the Digital Personal Data Protection Act, you operate as a Data Fiduciary. DigAI serves as your Data Processor. We provide explicit opt-in capture forms, purpose-bound contact attributes, clear contact deletion mechanisms, and an exportable audit timeline.
Have custom compliance or legal questions?
Our legal desk assists enterprise teams with DPAs, subprocessor reviews, and audit questionnaires.