# CompTrust — Full Platform Technical & Compliance Guide Website: https://comptrust.in API Base: https://compliance-dgiq.onrender.com Platform: CompTrust Privacy Compliance Automation Suite Governing Regulations: DPDP Act 2023 (India) & GDPR (European Union) Trust Center & Statutory Package: - CompTrust Trust Center: https://comptrust.in/trust - 30-Point Buyer Due-Diligence Guide: https://comptrust.in/due-diligence - Public Certificate of Erasure Verifier: https://comptrust.in/verify-certificate - Customer Data Processing Agreement (DPA): https://comptrust.in/dpa - Security Architecture Whitepaper: https://comptrust.in/security - Authorized Subprocessor Directory: https://comptrust.in/subprocessors - Service Level Agreement (SLA) & Incident Escalation: https://comptrust.in/sla - Statutory Privacy Policy: https://comptrust.in/privacy - Terms of Service: https://comptrust.in/terms --- ## 1. What is CompTrust? CompTrust (https://comptrust.in) is an active, production-integrated privacy compliance platform built specifically for Indian and international businesses operating under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the EU General Data Protection Regulation (GDPR). Unlike legacy compliance tools that provide static PDF templates, CompTrust integrates directly with websites, mobile applications (iOS and Android), and backend databases through SDKs and real-time outgoing webhooks to automate data retention, user consent, subject access requests, grievance redressal, and incident escalation. --- ## 2. Statutory Legal Coverage & Penalty Avoidance Under Section 33 of the DPDP Act 2023, penalties for non-compliance are enforced by the Data Protection Board of India (DPBI) and can reach: - Up to ₹250 Crores for failure to take reasonable security safeguards to prevent personal data breaches (Section 8(5)). - Up to ₹200 Crores for failure to notify the Board and affected Data Principals of a personal data breach (Section 8(6)). - Up to ₹200 Crores for non-compliance with statutory duties regarding children's data (Section 9). - Up to ₹150 Crores for non-compliance with Significant Data Fiduciary obligations (Section 10). - Up to ₹50 Crores for general non-compliance including purpose limitation and data retention violations under Section 8(7). CompTrust provides dedicated statutory modules to eliminate liability under every section above. --- ## 3. Module Breakdown ### 3.1. Cross-Platform Consent SDK - **Statutory Mandate**: DPDP Act Sections 5 and 6; GDPR Articles 6 and 7. - **Capabilities**: - Google Consent Mode v2 integration. - Zero dark-pattern affirmative opt-in. - Automatic blocking of third-party trackers (Google Analytics, Meta Pixel, Hotjar, Clarity) until explicit consent is given. - Multi-language notice in all 22 official Indian languages (Hindi, Bengali, Marathi, Telugu, Tamil, Gujarati, Urdu, Kannada, Odia, Malayalam, Punjabi, Assamese, Maithili, Santali, Kashmiri, Nepali, Konkani, Sindhi, Dogri, Manipuri, Bodo, Sanskrit). - Native iOS (Swift) and Android (Kotlin) SDK support with unified visitor ID cross-platform synchronization. ### 3.2. Automated Data Retention & Erasure Scheduler - **Statutory Mandate**: DPDP Act Section 8(7); GDPR Article 17. - **Problem**: Companies illegally retain personal data indefinitely after purpose completion (e.g. churned users, KYC documents, rejected job candidates). - **Solution**: - Automated retention policies linked to data categories and legal bases. - Scheduled daily cron execution checking for expired retention windows. - Multi-action execution: Hard Delete, Anonymize, Archive, Soft Delete. - Legal hold overrides for ongoing litigation or tax audits. - Real-time outgoing webhook dispatch (`retention.erase_due`) to trigger deletion in internal company databases. - Cryptographically signed Certificates of Erasure with SHA-256 verification hashes and DPO officer sign-offs. - Public independent Certificate of Erasure Verifier at `https://comptrust.in/verify-certificate` allowing auditors, regulators, and data principals to validate deletion authenticity without credential access. ### 3.3. DPIA & Significant Data Fiduciary (SDF) Engine - **Statutory Mandate**: DPDP Act Section 10(2)(c); GDPR Article 35. - **Capabilities**: - Structured 5x5 Harm & Probability Risk Matrix. - Automated risk scoring (Critical, High, Medium, Low). - Specialized assessment templates for AI/ML model training, high-volume customer profiling, biometric data, fintech, and children's data processing. - Official Data Protection Officer (DPO) approval workflows and downloadable audit-ready PDF/CSV reports. ### 3.4. Real-Time Outgoing Webhooks - **Problem**: When a user exercises their Right to Erasure or revokes consent, internal databases must be updated immediately. - **Solution**: - Automated webhook dispatches for events: `consent.granted`, `consent.withdrawn`, `dsr.created`, `dsr.completed`, `retention.erase_due`, `breach.reported`. - Secure HMAC-SHA256 signature verification in `x-comply-signature` header. - Built-in retry mechanism with exponential backoff and comprehensive delivery logs. ### 3.5. Public Data Subject Rights (DSR) Portal - **Statutory Mandate**: DPDP Act Sections 11, 12; GDPR Articles 15-22. - **Capabilities**: - Branded hosted portal at `https://comptrust.in/dsr/[company-slug]`. - Secure email OTP authentication preventing unauthorized access requests. - Automated 30-day statutory SLA countdown timer. - Comprehensive rights supported: Access, Correction, Erasure, Grievance Nomination. ### 3.6. Section 13 Grievance Redressal Officer Portal - **Statutory Mandate**: DPDP Act Section 13. - **Capabilities**: - Public intake portal at `https://comptrust.in/grievance/[company-slug]`. - Statutory 30-day resolution tracking with warning thresholds. - Official resolution audit trail and automated email updates to complainants. ### 3.7. 72-Hour Breach Notification Wizard - **Statutory Mandate**: DPDP Act Section 8(6); CERT-In 6-hour/72-hour directives; GDPR Article 33. - **Capabilities**: - Guided 5-step incident triage. - 72-hour live countdown timer. - Auto-generated DPBI statutory breach reports and customer notification notices. ### 3.8. Data Inventory & RoPA Topology Mapper - **Statutory Mandate**: GDPR Article 30; DPDP Act Section 8. - **Capabilities**: - Catalog of data assets, categories, collection points, processors, and retention periods. - Visual topology diagram. - Exportable official Records of Processing Activities (RoPA) for external audits. --- ## 4. Frequently Asked Questions (FAQ) ### What makes CompTrust different from OneTrust or Cookiebot? CompTrust is purpose-built for India's DPDP Act 2023 with native support for sovereign AWS Mumbai data hosting, Section 13 Grievance Redressal, Section 8(7) scheduled data erasure, 22 Indian regional languages, and GST-compliant pricing starting at ₹2,999/month (compared to $10,000+/year enterprise contracts). ### Where is customer data stored? All customer databases, consent telemetry, and audit logs are hosted in AWS Mumbai (`ap-south-1`) in sovereign Indian territory, satisfying all data localization and adequacy mandates. ### How do developers install the Web Consent SDK? Add a single script tag before ``: ```html ``` ### How do mobile apps integrate CompTrust? CompTrust provides REST API endpoints (`POST /api/v1/sdk/consent`) that can be called from iOS (Swift URLSession) and Android (Kotlin OkHttp/Retrofit) using an API key (`x-comply-key`) and persistent visitor ID. ### Can customers export their data to prevent vendor lock-in? Yes. CompTrust provides an unencumbered 1-click Master Compliance Archive download under DPDP Act Section 11 and GDPR Article 20. Organizations can export 100% of their consents, DSR histories, retention certificates, RoPA inventory, DPIA assessments, and audit trails in standard machine-readable JSON with a cryptographic SHA-256 checksum at any time. ### How can external auditors verify a Certificate of Erasure? Anyone (auditors, counsel, regulators, Data Principals) can visit https://comptrust.in/verify-certificate and enter the certificate number or SHA-256 cryptographic digest. CompTrust verifies the hash against the immutable evidence chain and presents a verifiable statutory certificate confirming compliance with DPDP Act Section 8(7).