FAQs
Questions, answered.
If something is not here, talk to us and we will answer it.
Getting started
What is DPDP Done?
A remote MCP server that turns the AI agent you already use into a DPDP auditor. It supplies the framework, the evidence discipline, the scoring and the certification. The reasoning happens in your agent.
Which agents work?
Any MCP-capable client, including Cursor, Claude, ChatGPT connectors and opencode. You add one endpoint and approve a sign-in once. There is no API key and nothing to install.
What does it cost to try?
The free tier connects your agent, gives you the whole knowledge base and certifies one report. No card needed to start.
The audit
Is this a questionnaire or a real audit?
A real audit. Every obligation becomes a specific evidence request, every artefact is hashed on receipt, and every sufficiency judgement must quote the passage it relied on. A control that exists is not a control that runs.
Can the scanner prove we comply?
No, and it never claims to. A scan shows a control is present from the outside; the engine caps scan evidence at completeness-verified. Only evidence of operating effectiveness reaches the top band.
Does it invent DP-F codes or penalty tiers?
No. Every code, provision, tier and score is retrieved from the knowledge base with a citation. Where the base returns nothing, the engine says so rather than guessing.
Reports and verification
Who is on the report?
Your firm's identity sits on the report: name, auditor, registration and logo. Set it once with the firm profile.
How is a report proved?
It is a PAdES-signed PDF with a registry record. The signature shows the document has not changed since issue, and the registry records that it was issued under a valid subscription. Public verification is paused for now while we rework it.
Is DPDP Done a certification scheme?
No. It is an audit engine. The Data Protection Board of India is the sole regulatory authority under the Act, and the report is not a legal opinion.
Data and privacy
Where does our data live?
The reasoning runs in your agent and the scanner runs on your machine. DPDP Done stores the audit record (organisation, scope, answers, findings, remediation) and the evidence you choose to attach, plus a SHA-256 hash of each artefact.
Do you sell or share our data?
No. Personal data is never sold. We are the Data Fiduciary for your account data and the Data Processor for the records you upload about your clients.
How do we exercise our DPDP rights?
There are working routes for access, correction, erasure and withdrawal at /rights and /withdraw, and the full Rule 3 notice is at /privacy in English and Hindi.
Plans and billing
What does Pro include?
Unlimited certified reports and tool calls on fair use, your firm's branding on every report, and the scanner and webhooks. Billed monthly or annually.
What does 'unlimited, fair use' mean?
Unlimited means fair use: generous per-period ceilings that an ordinary practice never reaches, so one account cannot degrade the service for everyone.
What happens if we stop paying?
Access ends. The next MCP call is refused and the plan shows as expired until a payment reactivates it. Nothing is deleted and every issued report stays in the registry.
Still deciding
Start on the free tier and run one audit.
Free to start. Pro is ₹500 a month introductory, or ₹5,000 a year.