# CompTrust — DPDP Act 2023 & GDPR Privacy Compliance Automation > CompTrust (https://comptrust.in) is India's leading enterprise privacy compliance automation platform designed specifically for the Digital Personal Data Protection Act, 2023 (DPDP Act) and the General Data Protection Regulation (GDPR). It helps startups, enterprises, and Significant Data Fiduciaries (SDFs) automate statutory compliance to prevent statutory fines up to ₹250 Crores. ## Core Capabilities & Modules - **Cross-Platform Consent SDK**: Zero dark-pattern consent banner for Web, iOS (Swift), and Android (Kotlin) with Google Consent Mode v2 support and statutory notice in all 22 Eighth Schedule Indian languages (DPDP Section 5(1)). - **Automated Data Retention & Erasure Scheduler (DPDP Section 8(7))**: Scheduled daily cron engine that automates purpose-limitation data purges (KYC records, churned users, candidate resumes) and generates cryptographically signed Certificates of Erasure with SHA-256 verification hashes. - **Data Protection Impact Assessment (DPIA) Engine (DPDP Section 10(2)(c))**: Mandatory risk assessment workflows for Significant Data Fiduciaries (SDFs) and high-risk processing (AI models, credit scoring, healthtech, children's data) featuring an interactive 5x5 harm matrix and DPO approval sign-offs. - **Real-Time Outgoing Webhooks**: Event-driven compliance that dispatches HMAC-SHA256 signed webhooks to downstream databases (PostgreSQL, MongoDB, Snowflake, CRMs) to trigger internal data deletion when consent is withdrawn or retention periods expire. - **Public Data Subject Rights (DSR) Portal**: Branded hosted portal with email OTP verification allowing citizens to exercise access, correction, and erasure rights with an automated 30-day statutory SLA countdown. - **Section 13 Grievance Redressal Officer Portal**: Mandatory grievance ticketing system with 30-day statutory SLA tracking, complainant communication logs, and automated closure notifications. - **72-Hour Breach Notification Wizard**: Guided incident triage and statutory notification generator for the Data Protection Board of India (DPBI) and CERT-In within the mandatory 72-hour window. - **Data Inventory & RoPA Topology Mapper (GDPR Art 30 / DPDP Sec 8)**: Visual data flow topology tracking data assets, processing legal basis, storage locations, and automated Records of Processing Activities generation. - **Public Certificate of Erasure Verifier (https://comptrust.in/verify-certificate)**: Public cryptographic verification portal allowing auditors, DPOs, and regulators to independently validate SHA-256 Certificates of Erasure and compliance audit reports issued under Section 8(7) without credential access. - **1-Click Master Compliance Export (Zero Vendor Lock-In)**: Complete data portability under DPDP Section 11 and GDPR Article 20, generating an unencumbered, SHA-256 checksummed JSON archive containing 100% of consents, DSR logs, retention certificates, RoPA inventory, and audit logs. - **Webhook Replay & Delivery Inspector**: Interactive delivery log inspection with HMAC-SHA256 signature verification and one-click replay capability to test server-side receipt and dead-letter queue resilience. - **Vendor DPA & Sub-Processor Manager**: Tracking third-party processors (AWS, Razorpay, Stripe, PostHog), DPA contracts, and renewal alerts. ## Pricing Tiers (INR, GST-Compliant) 1. **Starter Plan (₹2,999/month or ₹2,399/mo billed annually)** - Target: Early-stage startups and small websites. - Includes: Web Consent SDK (1 domain), DSR Portal with OTP, Privacy Policy Generator, Compliance Health Score, Manual Retention Policies, English & Hindi notices, 2 Team Members, 1-Year Audit Log Retention. 2. **Growth Plan (₹7,999/month or ₹6,399/mo billed annually) [Most Popular]** - Target: Scaling companies, fintechs, and consumer mobile apps. - Includes: Everything in Starter + Web, iOS (Swift) & Android (Kotlin) SDKs (up to 5 apps/domains), Automated Section 8(7) Retention & Erasure Scheduler with Daily Cron, DPIA Risk Assessment Engine, Real-Time Outgoing Webhooks (up to 5 HMAC endpoints), 72-Hour Breach Wizard, Section 13 Grievance Redressal Portal, Vendor DPA Manager, All 22 Indian Languages, 10 Team Members, 3-Year Audit Retention. 3. **Enterprise Plan (₹19,999/month or ₹15,999/mo billed annually)** - Target: Significant Data Fiduciaries (SDFs), high-volume apps, and enterprise platforms. - Includes: Everything in Growth + Unlimited Web & Mobile Apps, Full Multi-Action Retention Engine (Hard Delete, Anonymize, Archive) + Legal Holds, Full SDF Governance & Audit Reports, Visual RoPA Topology Mapper, Unlimited Outgoing Webhooks with Replay Logs, 7-Year Statutory Audit Retention & Cryptographic Certificates, Dedicated Compliance Officer + Legal SLA. ## Technical Integration - **Canonical Website**: https://comptrust.in - **Backend API**: https://compliance-dgiq.onrender.com - **Hosting Sovereignty**: AWS Mumbai (`ap-south-1`) sovereign Indian cloud. - **SDK CDN Script**: `` - **Native iOS (Swift)**: Integrates via URLSession to `${API_URL}/api/v1/sdk/consent` with visitor ID tracking. - **Native Android (Kotlin)**: Integrates via OkHttpClient/Retrofit to `${API_URL}/api/v1/sdk/consent`. - **Webhooks**: Signatures sent in `x-comply-signature` header using HMAC-SHA256 (`hex`). ## Public Legal & Trust Resources - **CompTrust Trust Center**: https://comptrust.in/trust - **30-Point Buyer Due-Diligence Guide**: https://comptrust.in/due-diligence - **Public Certificate of Erasure Verifier**: https://comptrust.in/verify-certificate - **Customer Data Processing Agreement (DPA)**: https://comptrust.in/dpa - **Security Architecture & Trust Whitepaper**: https://comptrust.in/security - **Authorized Subprocessor Directory**: https://comptrust.in/subprocessors - **Service Level Agreement (SLA) & Incident Escalation**: https://comptrust.in/sla - **Statutory Privacy Policy**: https://comptrust.in/privacy - **Terms of Service**: https://comptrust.in/terms ## Statutory References - Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, Republic of India) - Section 5: Notice requirements in 22 Eighth Schedule languages - Section 6: Affirmative, unbundled consent without dark patterns - Section 8(7): Mandatory erasure upon purpose fulfillment or consent withdrawal (fines up to ₹250 Crores) - Section 10: Significant Data Fiduciaries & mandatory DPIA assessments - Section 11, 12, 13: Data Principal rights & mandatory Grievance Redressal Officer - Section 33: Monetary penalties up to ₹250 Crores enforced by Data Protection Board of India (DPBI) - European Union General Data Protection Regulation (GDPR) - Article 6 & 7: Lawful grounds and consent - Article 17: Right to erasure (Right to be Forgotten) - Article 30: Records of Processing Activities (RoPA) - Article 33: 72-hour breach notification to supervisory authority - Article 35: Data Protection Impact Assessment (DPIA)