Allowing it lets Google Analytics and Google’s advertising measurement set an identifier and receive your IP address, the pages you view and how you reached them — used only to see which pages work and whether a campaign led to an enquiry, never to build a profile or to decide anything about you. Google processes this outside India, a cross-border transfer under Section 16. Declining changes nothing about the site, and you can change your mind any time from the footer. An analytics identifier is personal data, so the DPDP Act applies to it — though no Indian cookie statute requires this banner. We ask because we would rather you chose. What we collect and why

Developer SDK

Build DPDP compliance into your product. API-first.

RuleExpert is designed for engineering teams who want to automate consent capture, DSR workflows, breach response and vendor governance — not manage them by hand in a dashboard.

Request API access See integrations

REST endpoints

Across nine compliance modules, every one returning structured JSON.

18+

Pre-built integrations

AWS, Razorpay, WhatsApp and the platforms Indian teams already run on.

100%

India data residency

AWS ap-south-1 Mumbai — always. Nothing leaves the region.

OAS 3.1

OpenAPI spec

Importable into Postman and every generator that reads OpenAPI 3.1.

API overview

One API. Every DPDP obligation.

A clean REST API across all compliance modules. Every write operation generates a signed audit-log entry automatically — the record that section 33(2) will be read against.

Consent

Capture, itemise, withdraw and prove consent — every write signed and appended to the consent log.

Data rights

Open, verify, fulfil and close access, correction, erasure, nomination and grievance requests on the SLA clock.

Breach

Declare an incident, scope it from the registry, and drive the three Rule 7 duties from the moment of awareness.

Registry

Vendor governance

Link processors to purposes, track DPA state, and let sharing block automatically when an agreement lapses.

Evidence

Pull PII-free evidence packs with a SHA-256 manifest for any obligation, any period.

API design

Built for how engineers actually work

No SDK lock-in. No proprietary protocols. Clean REST, standard JSON and webhooks — so your team integrates in days, not weeks.

REST + JSON — nothing proprietary

Standard REST verbs, standard JSON payloads. Works with any HTTP client in any language.

Every write auto-signed

Every API write that creates a compliance record generates an HMAC-SHA256 signed audit-log entry.

Webhook-first event model

Subscribe to any compliance event and RuleExpert pushes a signed JSON payload to your endpoint in real time.

Authentication

API key + Bearer token. OAuth 2.0 for Enterprise plans.

Rate limits

1,000 requests/min on Starter, 10,000 requests/min on Growth.

Versioned — no surprise breaking changes

Six months' notice before any breaking change, with a migration guide included.

SDKs & integrations

Connect the tools your team already uses

Official SDKs, a Postman collection, and pre-built connectors for the platforms Indian engineering teams run on. The full OpenAPI 3.1 spec is available to registered developers.

Request the OpenAPI spec How we connect to your systems

In their words

What compliance teams tell us

“We always thought DPDP compliance was the client’s responsibility since we were only executing services. The evaluation made it clear that how we handle client data creates risk on our side too. It changed how we work internally.”

DSFounderDigital services firm

“We had a basic understanding of DPDP requirements, but the scorecard highlighted gaps we hadn’t identified internally — especially around consent handling and data visibility. It gave us a much clearer starting point.”

BSFounderB2B SaaS company

“The DPDP score was surprisingly insightful. Within minutes we could see where we stood and what needed immediate attention. It simplified something that initially felt quite complex.”

FPProduct HeadFintech platform

“After reviewing our score we opted for a consultation. The discussion was very practical — we got clear direction on what to fix first and how to approach DPDP compliance in a structured way.”

LGFounderLogistics company

Real client quotes, attributed by role and sector — we never name a client.

Consent capture that stands up in an audit.

HMAC-signed. Append-only. Live in your product in days.

Book a demo Check your DPDP score