Senior security and engineering for regulated fintech.
We help Indian and global fintech teams ship faster without inheriting regulatory debt. RBI-aware architecture, PCI-DSS scoping, DPDPA-by-design, real penetration testing — done by senior engineers who have shipped to production for banks, neo-banks, payment gateways, and lending platforms.
- 01Audit & RBI inspection readiness without slowing the team down
- 02PCI-DSS scope reduction (tokenization, vault, SAQ pathing)
- 03KYC / AML pipeline integrity + DPDPA consent handling
- 04API security for partner banks, aggregators, account-aggregator framework
- 05Fraud detection without false-positive flooding ops
- RBI MD-IT (Master Directions on IT)IT governance, third-party risk, BCP/DR, vendor concentration limits.
- RBI MD-ISMR (Master Directions on Information Security)ISMR controls, log retention, incident reporting timelines.
- DPDPA 2023Consent, purpose limitation, grievance officer, breach notification.
- PCI-DSS v4.0Cardholder data handling, scoping, SAQ pathing, ongoing controls.
- CERT-In 6-hour ruleMandatory incident reporting within 6 hours.
Managed SOC
Continuous detection for payment infra, KYC platforms, ledger systems.
Explore →PCI-DSS scoping + VAPT
Reduce PCI scope, harden in-scope systems, ship audit-ready evidence.
Explore →DPDP + GDPR programs
Consent architecture, DPIA, grievance handling, sub-processor governance.
Explore →Senior engineering pods
Embedded teams for ledger, KYC, fraud, payments orchestration.
Explore →AI for fraud + credit
Production-grade ML for fraud scoring, alternate-data underwriting, agentic ops.
Explore →Do you work with RBI-regulated entities?+
Yes. We have implemented controls aligned to RBI Master Directions for both banks and non-banks (PA/PG, NBFCs, lending platforms). We are familiar with the inspection cadence and audit expectations.
Can you do PCI-DSS implementation end-to-end?+
We do scoping, network segmentation, tokenization architecture, and audit-prep. We partner with QSAs for the formal assessment; we do not self-attest.
How do you handle the CERT-In 6-hour incident reporting requirement?+
Built into our SOC runbooks. We have detection-to-report templates ready; the clock starts at detection, not analysis-complete.
What is your typical engagement shape for fintech?+
Either a fixed-scope project (PCI scoping, audit prep, app pen-test) or a growth retainer (managed SOC + monthly VAPT + on-call IR). See /engage for the three shapes we work in.