Enterprise compliance for Indian and global workloads

Compliance expertise

Opsio's core service is helping regulated Indian and multinational enterprises achieve and maintain their compliance posture. Below, each framework shows what Opsio carries itself and what we deliver for customers. Supporting documentation is available for procurement review under NDA.

• DPDPA (India)

  India operations · Customer programs

  Opsio: operations at our Bangalore delivery center are aligned with India's Digital Personal Data Protection Act 2023. For customers: DPDPA readiness assessments, consent architecture, right-to-correction tooling, retention controls, and CERT-In incident reporting pipelines — delivered to BFSI, manufacturing, and SaaS customers across India.

• CERT-In (India)

  Customer implementation programs

  For customers: implementation of CERT-In's April 2022 directives — 6-hour incident reporting pipelines, 180-day log retention, mandatory KYC where applicable, and integration with a central SOC for automated reporting. Our SIEM integration patterns are production-ready for Indian deployments.

• ISO 27001:2022

  Bangalore scope · Customer programs

  Opsio: ISO 27001 certified at our Bangalore delivery center (scope covers operations staff and development activities there). For customers: we lead full ISO 27001 implementation programs — gap analysis, ISMS design, policy authorship, internal audit, and Stage 1/Stage 2 audit support. Indian customers have achieved certification via this approach.

• RBI / SEBI (India financial services)

  Customer compliance programs

  For customers in Indian BFSI: implementation of RBI's Master Direction on IT Risk Management, SEBI's Cyber Security and Cyber Resilience Framework — data classification, BCP testing cadence, third-party risk assessment, and incident reporting alignment. Our architects have delivered this for Indian banks and NBFCs.

• GDPR (EU 2016/679)

  Article 28 processor

  Opsio: data processor under GDPR Article 28 for European customer personal data we handle during managed operations. Standard Contractual Clauses on file for cross-border transfer to our India team. For customers: GDPR implementation support where Indian enterprises serve European users.

• SOC 2 Type II

  Customer readiness programs

  Opsio: not currently SOC 2 attested as a firm. For customers: SOC 2 readiness programs — control mapping, evidence automation, monitoring setup, and auditor liaison through the observation window. Especially relevant for Indian SaaS companies selling to US customers.

• HIPAA (US customers)

  BAA available · Customer architectures

  Opsio: Business Associate Agreement available for US healthcare customers. For customers: HIPAA-ready architectures on AWS Mumbai / Azure Central India with audit controls, encryption, and BAA chain management — relevant for Indian companies providing services to US healthcare.

Subprocessors

Opsio engages the following subprocessors to deliver services. The current authoritative list is maintained internally and provided as an annex to the DPA on request. Hyperscaler region selection is configurable per customer contract, with Indian customers defaulting to Mumbai / Hyderabad / Pune.

Customers may object to new subprocessors within the 30-day notice window. Engagement-specific subprocessors (monitoring agents, SIEM platforms, etc.) are disclosed in the Statement of Work.

Data residency

Customer production data is processed in the cloud region you select. For Indian customers we default to Indian regions (AWS ap-south-1 Mumbai, Azure Central India, GCP asia-south1 Mumbai) unless contractually agreed otherwise. European customers default to EU/EEA regions with SCCs governing any cross-border access by our India team.

Opsio personnel access customer environments via named accounts with MFA and just-in-time elevation. Delivery operations run from Bangalore (primary for Indian customers) and Karlstad (primary for European customers). Personnel access governed by Data Processing Agreements and SCCs where applicable.

Backups and logs inherit the customer's selected region by default. Cross-region replication for disaster recovery is customer-configurable — common pattern is Mumbai primary with Hyderabad DR for Indian customers.

Responsible disclosure

Security researchers who identify a vulnerability in Opsio-operated systems are encouraged to report it via encrypted email. We commit to acknowledging receipt within one business day and providing a remediation timeline within five business days. We do not pursue legal action against good-faith research that follows these guidelines.

Report to: security@opsio.se