Free toolDPDPA compliance auditPoint it at any domain and it scores the privacy policy against the DPDP Act, 2023About a minute. No login, no credit cardRun the audit
Blog New rules, new attacks, what to do about them.

No content agency. Written by the engineers who build it.

Cloud security, API protection, privacy law and the cost of getting any of them wrong - written by the people whose code ships it.

72+Articles
10Categories
WeeklyUpdates
72 articles
The CISO's Playbook for AI Governance: Moving Beyond "We'll Figure It Out Later"FeaturedAI Governance

The CISO's Playbook for AI Governance: Moving Beyond "We'll Figure It Out Later"

Most enterprises have AI in production. Far fewer have a policy governing it. A five-pillar framework - inventory, classification, access control, monitoring, decommission - plus how to put AI risk in front of a board in currency rather than jargon.

Updated Sep 8, 202611 min read
The DPDPA Countdown: 9 Compliance Gaps Every DPO Must Close Before 13 May 2027Data Privacy

The DPDPA Countdown: 9 Compliance Gaps Every DPO Must Close Before 13 May 2027

The DPDP Rules were notified in November 2025. Penalties commence 13 November 2026 and full compliance is due 13 May 2027. The nine gaps that take longest to close, ranked by lead time, with a 120-day readiness sprint.

Updated Sep 8, 202611 min readEU AI Act + DPDPA + Sectoral Rules: Navigating a Multi-Jurisdiction Compliance MazeGRC

EU AI Act + DPDPA + Sectoral Rules: Navigating a Multi-Jurisdiction Compliance Maze

An Indian fintech serving EU customers now answers to four regimes at once. Where a highest-common-denominator control set works, where it genuinely fails, and how one control mapped many ways cuts duplicate testing.

Updated Sep 8, 202610 min readAI Model Risk Is Now Board Risk: What CISOs Must Report in the Next Quarterly ReviewAI Governance

AI Model Risk Is Now Board Risk: What CISOs Must Report in the Next Quarterly Review

Translating hallucination, drift and bias into enterprise-risk language. What belongs in an AI model register, the five numbers boards actually want, and a one-page heatmap that asks for exactly one decision.

Updated Sep 8, 20269 min readConsent Under DPDPA Is Not a Checkbox: Architecting a Consent Lifecycle That Survives AuditData Privacy

Consent Under DPDPA Is Not a Checkbox: Architecting a Consent Lifecycle That Survives Audit

Section 6 read as an engineering specification. Consent receipts, verifiable parental consent, Consent Manager interoperability, withdrawal propagation - and the unsolved problem of withdrawing consent from a trained model.

Updated Sep 8, 202610 min readShadow AI in the Enterprise: The Governance Blind Spot Keeping CISOs Up at NightAI Governance

Shadow AI in the Enterprise: The Governance Blind Spot Keeping CISOs Up at Night

Marketing has a copywriter. Finance has a notebook. HR is screening CVs. Five discovery techniques, a risk taxonomy, and an acceptable use policy people will actually follow - plus why embedded AI in approved SaaS is the bigger exposure.

Updated Sep 8, 20269 min readBuilding a Data Protection Impact Assessment (DPIA) Engine That Doesn't Collect DustData Privacy

Building a Data Protection Impact Assessment (DPIA) Engine That Doesn't Collect Dust

Most DPIAs are Word documents nobody reopens. How to build trigger-based reassessment wired to your data catalogue and MLOps pipeline, a defensible scoring methodology, and DPIA gates inside CI/CD.

Updated Sep 8, 20268 min readThird-Party and Fourth-Party AI Risk: Your Vendor's LLM Is Your Regulatory ProblemGRC

Third-Party and Fourth-Party AI Risk: Your Vendor's LLM Is Your Regulatory Problem

The AI supply chain runs six layers deep and your contract covers one. Due-diligence questions specific to AI vendors, contract clauses that actually bite, and how to assess the GPU cloud you have never heard of.

Updated Sep 8, 202610 min readFrom Reactive to Predictive: How GRC Automation Turns Compliance into a Strategic LeverGRC

From Reactive to Predictive: How GRC Automation Turns Compliance into a Strategic Lever

Around 60-70% of compliance effort requires no human judgement at all. What genuinely automates, what does not, how predictive signals flag controls before they fail, and an ROI framework a CFO will not pick apart.

Updated Sep 8, 202610 min read

Stop overpaying for cloud

DeDups identifies hidden savings and security gaps across your AWS environment - automatically.