Significant Data Fiduciaries must run an independent audit every year. That obligation begins 13 May 2027.See how it works

Your agent becomes a DPDP auditor.

DPDP Done is a DPDP audit engine you reach over MCP. Add one line, sign in once, and the assistant you already use can scope an audit, work the obligations, and produce a signed report.

Connect to MCPFor auditorsFor developers
✳ClaudeSonnet
Are we DPDP ready? We are Astra Fintech, with children's data and AI systems.
Yes, mostly. I scoped 14 of 18 domains as applicable, 6 of them core. Children's data is the first gap.
create_assessment✓ Astra Fintech
determine_scope✓ 14 of 18
get_obligation · DP-F-9.1✓ cited
DP-F-9.1 · Children's Data · S.9 · tier P2
Verifiable parental consent before processing a child's data.
Message Claude ↑
Why now

The audit is becoming a duty, not a choice.

Full DPDP obligations begin 13 May 2027. Significant Data Fiduciaries must run an independent audit every year and appoint an India-based DPO. Every other data fiduciary still owes notice, consent, security, retention and breach duties. Most organisations have not been audited against any of it.

₹250 cr
the top penalty tier in the Schedule
203
codified obligations, each with its provision and tier
18
audit domains, mapped to the Schedule
740
source pages, every answer cited to one
How it works

We beam DPDP knowledge and expertise to your agent.

Three easy steps:

01
Connect

Add the endpoint to your agent and approve the sign-in once, in your browser.

Connect to MCP
02
Work

Your agent scopes the domains, works the 199 obligations, and asks for evidence wherever an answer is weak.

03
Certify

The engine signs the report, records it, and can even put your branding on it.

The knowledge is not a prompt. It is the framework Cyber Vigilance Group authored, codified and tested.

Every answer cites its source
199 obligations across 18 domains, each with its provision, its penalty tier, and the page it came from.
The framework is ours
DPDP Done runs on the DPDP Auditing Framework 1.0 and the Audit Field Guide 1.0, both authored by Cyber Vigilance Group.
Nothing is invented
No code, provision, tier, finding or score is generated. Where the knowledge base returns nothing, the engine says so.
Who it is for

Built for Auditors and Devs

How do I add DPDP to my practice?

  • Win the engagement: scope it and deliver it on the framework the engine already holds.
  • Hand over a signed report carrying your firm's name, registration and logo.
  • The fieldwork runs in your agent, so a junior can run it and a partner reviews it.
  • Price it like the market does: readiness in the low lakhs, audits higher, retainers monthly.
Chartered AccountantLawyerCompany Secretary
For auditors
Connect

One line, one consent screen.

Full instructions
The endpoint
https://www.dpdpdone.com/mcp

Sign-in is OAuth 2.1, handled once by your assistant in a browser tab. There is no API key to generate or paste, and nothing to install.

Claude Code, one line
claude mcp add --transport http dpdpdone https://www.dpdpdone.com/mcp

Any MCP-capable agent works the same way. See the full guide.

Pricing

Free to start. Pro for unlimited.

Full comparison
Free
₹0
forever

Find out where you stand, then certify one report on us.

  • Connect the AI agent you already use
  • The full knowledge base: 199 obligations
  • Unlimited draft audits
  • 1 certified report, once
Connect to MCP
Pro
₹500
per month, introductory · ₹5,000 a year

Unlimited audits for one auditor, at an introductory price.

  • Unlimited certified reports, fair use
  • Unlimited tool calls, fair use
  • Your firm's branding on every report
  • All 40 tools, the scanner and webhooks
Start Pro
Enterprise
On request
custom · on-premises

For firms with volume, procurement or on-premises needs.

  • Custom seats and volumes
  • On-premises or private deployment
  • White-label reports
  • Onboarding, an SLA and a named contact
Talk to us
Security

Your data stays yours.

The reasoning runs in your agent and the scanner runs on your machine. Here is exactly what we hold, and what we never do.

What we hold
  • The engagement record: scope, control answers, findings and remediation.
  • The evidence you choose to attach, and a SHA-256 hash of each artefact.
  • Report metadata, signatures and hashes, never the report body.
What we never do
  • Reach into your client's systems.
  • See your source code or your logs.
  • Train anything on your data.

Evidence, not answers

Every artefact is hashed on receipt, so tampering is detectable and custody is provable.

A claim is not evidence

The client's word is recorded as a claim. Sufficiency is a separate judgement, and it needs a quote.

A signed, portable report

A PAdES-signed PDF with a registry record, carrying your firm's identity alongside the engine.

Your data stays yours

The reasoning runs in your agent; the scanner runs on your machine. We store the audit record and the evidence you attach, not your client's systems.

FAQ

The questions that decide it.

All questions
Why not just use ChatGPT?

You can, and your agent is the interface here too. What it does not have on its own is a framework, citations, an evidence rule, or a signed report. DPDP Done supplies those behind your agent.

Is a free checklist not enough?

A checklist records what you were told. The engine refuses a sufficiency verdict that does not quote the passage it relied on, so the report shows what you can prove.

Do you get my client's data?

The reasoning runs in your agent and the scanner runs on your machine. We store the engagement record, the findings and the evidence you choose to attach, plus a SHA-256 hash of each artefact.

Is this legal advice or a certification?

No. It is an audit engine. The Data Protection Board of India is the sole regulatory authority under the Act.

Run your first audit today.

Just paste one line and sign in.

Takes about ten minutes to the first finding.

Connect to MCPFor auditors