Platform · Architecture and deployment

One platform. Twelve capabilities. Your infrastructure.

AutoCops is a single integrated workspace for every DPDP control — deployable to your own GCP region, your own KMS keys, your own VPC. The platform is open, inspectable, and built so you can leave cleanly if you ever want to. Below is exactly how it works.

Four architecture principles

How the platform is built

01

Single workspace

Twelve capability modules — DSPM (new in v2.1.3), consent, cookies, DSR, breach, DPIA, vendor risk, grievance, notices, controls, training, executive dashboard — all live behind one login, share a single audit trail, and roll up into one compliance posture.

02

India-resident by default

Deployed to your own GCP, AWS, or Azure region in asia-south1 (Mumbai). Personal data of Indian Data Principals never leaves the country. No shared multi-tenant cluster you'd be on.

03

Open architecture

Every record is exportable. Every workflow is inspectable. Every API is documented. Customer data stays the customer's data. We earn renewals by being useful, not by holding your data hostage.

04

Hot-patch infrastructure

When the DPDP Rules change or the Data Protection Board issues guidance, we ship updates in days, not quarters. Customers receive rule changes via in-place hot-patch — no scheduled maintenance windows.

The 12 capability modules

Every DPDP control, one workspace

All twelve modules ship in every deployment. You enable the ones you need now and turn the others on later as your programme matures.DSPM is new in v2.1.3.

New · v2.1.3
D

Data Security Posture Management

Discover, classify, and govern sensitive data across your stack — with every finding tied back to a DPDP section, a Data Principal, and a documented purpose.

CM

Consent Management Platform

Itemized notice, granular capture, audit-ready withdrawal across web, mobile, and offline channels.

CM

Cookie Consent & Banner

Auto-discover, classify and govern cookies. Drop-in banner with Google Consent Mode v2 support.

DP

DSR & Rights Fulfilment

Logged, deadline-tracked workflow for access, correction, erasure, portability, and nomination requests.

BM

Personal Data Breach Response

Triage, classify, notify the Data Protection Board within 72 hours, and document the post-incident review.

D

Data Protection Impact Assessment

Structured DPIA workflow tailored to Significant Data Fiduciary obligations. Versioned and approver-signed.

VR

Third-party & Vendor Risk

Inventory processors, score them against DPDP clauses, and refresh diligence on a defined cadence.

GR

Grievance Officer Workflow

Receive, triage, escalate and resolve grievances within statutory SLAs. Audit trail to the Board.

PN

Privacy Notice Builder

Layered, multi-language notices generated from your processing activities. Versioned and signature-ready.

CA

DPDP Control Assessment

Pre-loaded DPDP control framework, assigned to owners, with status, evidence, and overdue tracking.

T&

Privacy Training & Enablement

Role-based modules, quizzes, completion tracking, and compliance certificates for every team.

ED

Executive Compliance Dashboard

Board-ready posture, implementation roadmap, category compliance, and timeline tracking — live.

Under the hood

Architecture overview

A capability-level look at how the platform is built. Specific frameworks, runtime versions, and library inventories are available to enterprise customers and security reviewers under NDA — request them via the contact page.

LayerCapabilityPurpose
FrontendModern single-page operator UIOperator-facing application interface
APIHardened REST API with role-based access controlBusiness logic and data orchestration
Data storeDocument-oriented store with full-text search and audit indexingRecords, evidence, and analytical queries
Identity & sessionsUsername + password + mandatory TOTP MFA, signed server-side sessionsAuthentication and session management
EncryptionStrong symmetric encryption at rest, modern TLS in transit, customer-managed keysData protection
AuditHash-chained, tamper-evident ledger with cryptographic integrity proofsForensic-grade audit trail
DeploymentContainer-orchestrated, multi-cloud (your GCP / AWS / Azure region)Hosting model
ObservabilityVendor-agnostic metrics, traces, and structured logsOperational visibility

Deployment

Three ways to run AutoCops

Same software, three operational models. Pick the one that fits your security and ops posture.

Recommended for Indian enterprises

Self-hosted on your GCP

  • Deployed to your own GCP project in asia-south1
  • Your KMS keys, your VPC, your IAM
  • No shared multi-tenant cluster
  • Full data residency in India
  • Operated by your team, supported by ours

Recommended for SMBs and growing teams

Managed single-tenant

  • Dedicated AutoCops-hosted instance just for you
  • Single-tenant database, single-tenant compute
  • All data still in asia-south1 (Mumbai)
  • Operated and supported by AutoCops
  • Faster to set up than self-hosted

For air-gapped environments

On-premises

  • Deployed to your own data centre or private cloud
  • Air-gap support — no outbound calls required
  • Manual update channel (no automatic updates)
  • All data physically on-premises
  • Audited by your own team

Integrations

Connects to what you already run

AutoCops connects to the systems your team is already using. For anything that isn't natively supported, the generic REST/GraphQL connector handles it.

Databases

PostgreSQLMSSQLOracleMongoDBElasticsearch

Identity

Active DirectoryOktaGoogle WorkspaceMicrosoft Entra ID

CRM

HubSpotSalesforceZohoPipedrive

Communications

Email (SMTP)SMS gatewaysWebhooksWhatsApp Business API

Storage

GCSS3Azure BlobLocal filesystem

Generic

REST APIGraphQLCSV importManual operator workflow

Security architecture

The full security story is in the Trust Center

Encryption at rest and in transit, hash-chained audit ledger, MFA-mandatory authentication, network isolation, quarterly pen tests, ISO 27001 certification in progress, SOC 2 Type II audit scheduled — and the full sub-processor list. Read the long-form version below.

See it on your data

Book a 30-minute platform walkthrough

Our compliance engineering team will demo any module live on your environment. Bring your security questions — we like the technical ones.