Working papers from the engagements, not brochures from the marketing team.
Eight longer-form papers on DPDP compliance, AI security, AI governance and enterprise AI — written by the people who run the assessments and build the systems. All eight are published in full on this site — no form, no email address, no waiting.
Working documents, written by the people doing the work.
Each paper started as internal material — a register structure we kept rebuilding for clients, a test checklist our red team uses, a decision framework we drew on a whiteboard often enough to write down. They are 10 to 16 pages, have tables and checklists in them, and assume you already know your own environment.
- No product pitch. Our services get a page at the back. The rest is method.
- Indian regulatory context first — DPDP, RBI, IRDAI and sector guidance, not GDPR commentary with the names swapped.
- Structures you can copy — register columns, checklist items, decision criteria, RACI splits.
- No invented statistics. Where we give a number it describes how we work, not a result we promise you.
Useful to you if you are…
- A DPO or compliance head building a retention schedule that two regulators and the DPDP Act can all live with.
- A CISO or security lead working out how LLM and agent risk fits your existing testing programme.
- A CTO or head of engineering with an agent pilot that demos well and has not shipped.
- A CIO or CDO deciding between hosted APIs and models inside your own boundary.
- An internal auditor or risk head who has been asked for an inventory of AI systems and does not have one.
If what you need is outside our scope, we will tell you on the call rather than send you a paper that does not answer it.
Eight papers. Pick the one that matches the decision in front of you.
There is no download wall and no instant PDF. Request a paper, and a person sends it by email — usually the same working day — with a short note on which sections apply to your sector.
The Retention-vs-Erasure Playbook for DPDP
How to reconcile RBI, IRDAI and tax retention mandates with DPDP erasure rights: a data-element register, withdrawal SLAs and defensible erasure exceptions.
Prompt Injection: A Field Guide for Security Teams
Direct and indirect injection across documents, email, RAG chunks and tool outputs — with the defence validation checklist our testers actually use.
Why Agent Pilots Stall Before Production
The permission, logging and human-checkpoint decisions that separate agents that ship from the ones still stuck in demo mode.
Point-in-Time vs Continuous: Rethinking the Annual VAPT
What changes when penetration testing has a rhythm — closure evidence, quarterly reporting and an audit-ready findings register.
Building an AI System Register Your Auditor Will Accept
What belongs in a model and agent inventory — owner, purpose, risk tier, data lineage — and how it feeds AI governance.
DPDP for BFSI: The KYC Retention Problem
Where lending and payments products get consent and retention wrong, and the register structure that satisfies both the RBI and the DPDP Act.
Consent That Travels: DPDP for Multi-Provider Healthcare
Why admission-time consent doesn’t cover labs, insurers and AI diagnostic tools, and how to design consent that follows the record.
Private AI: When the Data Cannot Leave
A decision framework for VPC and on-prem model hosting versus hosted APIs — residency, cost, GPU sizing and the operating burden nobody budgets for.
Every paper is readable in full on this site. Nothing is gated and we ask for no email address to read one. If you would rather have a PDF to circulate internally, or want the version written for your sector, ask us and we will send it.
Want more than one, or a version written for your sector — banking, healthcare, government, education?
Ask for the setFour steps, and none of them start with a content calendar.
A question keeps recurring
The same problem comes up on scoping calls three or four times — retention versus erasure, or why the agent pilot will not pass security review. That is the trigger to write.
The practitioner drafts it
Written by whoever does that work: the tester who runs the injection cases, the consultant who builds the data-element register, the engineer who sized the GPUs.
Reviewed across disciplines
Security reviews the AI papers, privacy reviews the security papers. Statements about the DPDP Act are kept general and accurate rather than predictive.
Dated and revised
DPDP rules and sector guidance are still moving. Papers carry a revision date, and we reissue them when something changes materially.
Structures, not slogans
Register columns, checklist items and decision tables you can lift into your own documents. If a section cannot be acted on, it gets cut.
Written for Indian obligations
Built from the DPDP Act and Indian sector regulators outward. Where a paper touches law, it stays general — the specifics belong with your counsel.
Ends with what to do
Every paper closes with a sequenced list of next actions and who should own each one — the same standard our assessment reports are held to.
Tell us which paper, and we will send it.
Or describe the decision you are trying to make — a specialist will point you to the right paper, or tell you honestly that we do not have one yet.