DPDP Act 2023 Compliance

As a technology provider and data processor, Toolsbots supports clients who act as data fiduciaries. We implement technical and organisational measures so personal data is collected for specified purposes, stored minimally, protected in transit and at rest, and deleted or returned when engagements end.

Our AI projects include privacy impact assessment templates, lawful basis documentation, and subprocessors lists (cloud, LLM APIs) reviewed during discovery.

• AES-256 encryption at rest; TLS 1.2+ in transit
• RBAC and SSO integration (SAML/OIDC) for enterprise apps
• Immutable audit logs for data access and AI inference requests
• Data residency on AWS ap-south-1, Azure Central India, or on-premise
• Automated PII detection/redaction before model fine-tuning
• Consent capture UI components for web and mobile
• Retention policies with scheduled purge jobs

RAG indices may embed employee or customer documents — access filters enforce purpose limitation. Voice AI pilots require explicit consent for recording and defined retention. We advise clients on whether outputs constitute personal data and how to honour erasure requests when vectors cannot be trivially unlinked (re-index strategies).

We respond within applicable timelines and coordinate with client fiduciaries on joint projects. Grievance escalation paths are documented in client contracts.

Clients receive transparency on which third parties process data. On-premise and air-gapped options eliminate external LLM subprocessors where required — common in BFSI and defence programmes.

Security incidents affecting personal data trigger documented escalation within business hours, root-cause analysis, and remediation plans shared with affected fiduciaries. Website visitors may contact privacy@toolsbots.com for access, correction, or deletion requests. Grievance officers are identified in client contracts for enterprise engagements.

Discovery workshops produce records of processing activities templates listing purposes, data categories, recipients, retention, and security measures. We update RoPA when subprocessors, hosting regions, or model vendors change. Enterprise clients receive change notifications on retainer when material updates affect their deployments.

Website visitors contact Toolsbots directly for corporate site data. Client-project personal data requests route through the fiduciary with Toolsbots support as processor. We train client administrators on erasure and correction workflows including vector re-index strategies where embeddings cannot be trivially unlinked.

Discovery workshops produce architecture diagrams, data flow maps, subprocessor lists, and acceptance tests referencing our Responsible AI charter, DPDP compliance overview, and AI security framework. Government and healthcare clients receive model cards, penetration test summaries, and training materials suitable for audit committees. Mid-market clients receive right-sized documentation without enterprise bureaucracy — but never empty promises about "AI magic."

Review delivery methodology, pricing ranges, and case study ROI metrics alongside these policies when evaluating Toolsbots for your programme. Procurement officers should attach these URLs to internal vendor diligence packs and security questionnaires.

Toolsbots reviews responsible AI, security, and privacy policies at least quarterly and after material incidents or regulatory updates. Clients on retainer receive change summaries affecting their deployments — for example new LLM subprocessors, revised data residency options, or updated incident response timelines. Website policy pages show effective dates; enterprise contracts may include client-specific addenda superseding general summaries where negotiated.

Toolsbots supplies architecture diagrams, subprocessor registers, model cards, penetration test summaries, and incident response playbooks during enterprise sales cycles. Policies on this site are the public summary; executed contracts may include client-specific security schedules and data processing agreements superseding general website text where negotiated.

Toolsbots maintains incident severity definitions, escalation contacts, and communication templates for enterprise retainers. Public website policies summarise our posture; executed MSAs define notification windows, forensic cooperation, and remediation responsibilities. Government and healthcare clients receive post-incident root-cause summaries suitable for audit committees when personal or clinical data may be affected.

We encourage buyers to validate BhoomiChain parcel counts, SecureSign branch deployments, and Doctshub clinic metrics through reference conversations and staging demos. Off-site review platforms and open-source contributions supplement on-site trust documentation. Link these URLs in vendor diligence packs alongside policies on this page.