CognoShift builds hardware-anchored compliance tooling for India’s regulated entities — SEBI CSCRF, RBI / NBFC, CERT-In and the DPDP Act 2023 — so that what an auditor or regulator asks for already exists as signed, tamper-evident evidence.
Mission
Every regulated Indian organisation — a SEBI-registered intermediary, an NBFC, a school, an MSME, a hospital, a government department — should be able to prove its compliance without hiring a compliance team. We build the platform that makes that possible, from the endpoint to the audit report.
What we do
Sanad DPO
DPDP toolchain — consent receipts, rights workflows, incidents, RoPA, DPIA, vendors, retention. Sector starter packs auto-loaded for school / MSME / clinic / hospital.
Sanad Sentinel
Windows endpoint agent. Produces SEBI CSCRF and CERT-In evidence — log retention, patch state, encryption status — anchored to TPM 2.0 hardware. EV-signed MSI installer.
Authority Console
Multi-tenant oversight for state / district administrations. Bulk provisioning, real-time posture, signed quarterly reports.
Sanad Verify API
Public, cryptographically signed compliance verification for insurers, lenders, district administrations and auditors.
Company
Patent stack
P1 — Kernel-Level Sovereign Ingress Filter
FiledApplication 13519IN001 — ring-0 filter for hardware-enforced data residency
P2 — Architecture-Agnostic TPM Attestation
FiledApplication 13519IN002 — cross-vendor TPM 2.0 attestation rail
P4 — Multi-Regulatory Compliance Deduplication
IDF (Lex Orbis)Single-evidence-multi-regulator architecture for DPDP/CERT-In/SEBI/RBI
P5 — Authority-Bounded Verification
IDF (Lex Orbis)Per-authority API key boundary for jurisdictional verification
Regulatory standing
DPDP Act 2023
Architecture aligned with §4–§14 + Rules
CERT-In compliance
4 Direction 70B/2022 obligations + 16-item best-practice checklist, telemetry-driven
CIAD-2026-0020
All 9 measures captured by Sentinel agent
Data residency
Supabase Mumbai (AWS ap-south-1) + Vercel edge
Infrastructure
Hosting: Vercel edge (Mumbai region) + Supabase (AWS ap-south-1, Mumbai). All customer data India-resident by default.
Cryptography: Ed25519 signatures, SHA-256 chain, optional TPM 2.0 hardware anchoring. Open-source verifier SDK (JS / Python / Go).
Data at rest: AES-256-GCM. RLS-enforced multi-tenancy. No tenant data ever leaves India unless the tenant explicitly authorises a cross-border transfer.
Endpoint agent: Sanad Sentinel — EV-signed Windows MSI (GlobalSign EV cert). GPO-deployable. Service-level supervision via NSSM.
Talk to us
Pilot enquiries, government partnerships, or DPDP compliance questions. We respond within one working day.