Your clients will ask. Have the answers ready.
When you process data for clients, they carry the duty and pass it to you by contract. Security questionnaires are already arriving.
Scan your website
Read-only and free. Nothing on your site is changed.
The personal data you hold
- Client users' names, emails and logins
- Data your clients upload into your product
- Support tickets and call recordings
- Usage logs and IP addresses
- Your own staff and candidate data
Where businesses like yours slip
Privacy notice covers the required items
A notice that mixes your own data with client data and never explains who is responsible for what.
A way for people to exercise their rights
No way for end users to raise a request that reaches the right client quickly.
Security headers in place
Missing basic browser protections on login and app pages.
Every page served over HTTPS
Old pages or subdomains still served without encryption.
Common questions
Are we a Data Fiduciary or a Data Processor?
Usually both. You are a processor for your clients' data and a fiduciary for your own users, leads and staff. Each role has different duties.
Can we host data outside India?
Transfers abroad are allowed except to countries the government restricts. Check your hosting regions against any list it notifies.
What do clients expect from us?
A contract that limits use to their instructions, sound security, fast breach alerts, and help answering people's requests about their data.
This page is general information, not legal advice.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.