For procurement, vendor management and compliance · India
You have to clear us before anyone can buy us.
Sastrum is built to pass an Indian regulated firm's outsourcing assessment: deployment your way, a security pack on request, and a contract written for regulated firms.
Your situation
A cloud vendor is an outsourcing decision, and the regulator will ask to see it.
Problems
- RBI's outsourcing directions make every material service provider your problem, with data localisation for payment data and a contract the inspector may read.
- Most vendors answer the security questionnaire slowly, partially, or with marketing.
- Data residency, access and exit terms get settled late, after the business has already chosen.
Needs
- Clear hosting options and regions, stated once and not changed in the sales cycle.
- A security pack that answers the questionnaire: data handling, access, continuity, testing, what is certified and what is not.
- A price model with no surprises, and a contract that fits the outsourcing policy.
Desires
- Clear a vendor in weeks, not months, with the documents already in hand.
- One contact who answers the same day.
What you would love
- A vendor who sends the due-diligence answers before you ask for them.
- An exit plan written into the contract from the start.
Three things that are different
Built to be assessed, not just bought.
- 01
Deployment your way.
SaaS, private cloud in your own account, or on-premise, the same product in each case. Hosting in an Indian region is stated in the contract, and the on-premise option keeps everything, including the AI models, inside the country.
- 02
A security pack on request.
Data handling, hosting, access control, business continuity, a penetration test summary, and the certifications SecurEyes holds. Nothing is claimed that the pack cannot show.
- 03
A vendor you can assess.
SecurEyes, the company that built Sastrum in India, is a cyber security consultancy of twenty years that stands behind the product and the contract, and answers your due-diligence questionnaire itself.
Coverage for India
The standards your assessment will check against.
The frameworks your own firm answers to are mapped in the product, which is also what your assessment of us will measure.
Your regulators
Frameworks for you
- RBI CSF
- SEBI CSCRF
- CERT-In directions
- DPDP
- MeitY
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Co-operative banks, NBFCs, microfinance lenders, insurers and brokers
RBI CSF, SEBI CSCRF, IRDAI, DPDP, CERT-In
Why this matters now
The obligations are dated and the penalties are public.
Indian figures, each linked to its source.
353
penalties imposed by the RBI on banks and other regulated entities in FY25
₹25.5 cr
average cost of a data breach in India, 2026
₹250 cr
maximum penalty under the DPDP Act
6 hours
to report a cyber incident to CERT-In
Start the assessment with the pack in hand.
Tell us which questionnaire you use and we will answer it, with the hosting options and a draft contract.