Compliance
Compliance in India, plainly
The laws and standards we design to, and the audit plan, with nothing described as a certification.
The short answer
Demystify OS is aligned with GDPR, DPDP and CCPA by design. It is designed with ISO 27001 and SOC II in mind and is not certified. Audits are planned for Q1 2027, for readiness only. DPDP's next phase starts 13 May 2027.
At a glance
Where we stand
GDPR, DPDP and CCPA aligned, row-level security, encrypted storage. Aligned is a statement of design, not a certification.
Designed with ISO 27001 and SOC II in mind. Not certified. Audits Q1 2027 (readiness only).
Customer records are held in India (Mumbai) with row-level security. Where model calls are processed is still being closed, so we make no residency claim for them.
The layers
Trust, layer by layer
Designed with ISO 27001 and SOC II in mind. Not certified. Audit readiness target: Q1 2027.
Read the diagram
- Records in India (Mumbai): Available. Records basis: 4 Nov 2026. This statement concerns stored customer records; it does not describe model-call residency.
- Row-level security: Available. Control basis: 4 Nov 2026. Record access uses row-level security.
- Encrypted storage: Available. Control basis: 4 Nov 2026. Stored customer records are encrypted.
- Human approvals: Early access. Design reviewed: 4 Nov 2026. Approvals are designed to put a person on consequential actions. This is not a guarantee of an outcome.
Laws and standards
Each one, with its status and date
India DPDP ActAvailable4 Nov 2026
Aligned by design: plain-language notice and recorded, withdrawable consent, starting with the beta application form.
Erasure keeps the de-identified decision record, so an audit trail survives a request to forget a person.
DPDP phase starting 13 May 2027Building now13 May 2027
We are mapping our consent and erasure flows to the obligations that start on this date.
This is planning work. It is not a claim that we already meet the later obligations.
GDPR and CCPAAvailable4 Nov 2026
Aligned by design, which matters for customers with people in Europe or California.
Aligned is a statement about how it is built. It is not a certification or a legal opinion.
CERT-In incident reportingBuilding now4 Nov 2026
Designed to follow India's incident-reporting expectations as an operating default.
The written procedure is in preparation. Treat it as planned, not as proven.
GSTEarly access4 Nov 2026
Demystify OS is built for Indian GST workflows, and every Demystify OS price we show says plus GST.
GST skills appear in the registry on the Skills page with their own status.
ISO 27001 and SOC IIBuilding nowQ1 2027
Designed with ISO 27001 and SOC II in mind. Not certified. Audits Q1 2027 (readiness only).
Readiness work only. No certificate is held, and no report exists to share.
Statuses checked on 4 Nov 2026.
Questions
Questions, answered
Do you hold SOC II or ISO 27001 certification?
Designed with ISO 27001 and SOC II in mind. Not certified. Audits Q1 2027 (readiness only).
Which laws do you design to?
GDPR, India's DPDP Act and CCPA. Aligned means built to follow their principles, not certified.
What happens when someone asks to be forgotten?
Their personal details are removed. The de-identified decision record stays so the audit trail is designed to stay intact.
Where are records held?
Customer records are held in India (Mumbai) with row-level security. Where model calls are processed is still being closed, so we make no residency claim for them.
Keep exploring
Security, trust and compliance
Next step
Apply for the beta
Demystify OS is an invite-only beta. A person is designed to read each application.