Your employees use AI tools.DPDPA holds you responsible.Pyroniq makes you provably compliant.

We request two read-only Graph API permissions: Application.Read.All (to see OAuth-connected apps) and Directory.Read.All (to see consent grants and directory context). The scan never requests write permissions, and we never access email content or files. If you later enable one-click revocation, your admin grants one additional permission through a separate Microsoft consent screen — it is never part of the initial connection.

We store what your DPDPA evidence requires, and nothing more. The scan stores app and OAuth consent metadata — including which user consented to each app, because remediation is impossible without it. If you use our governance modules, we also store employee records (names, work emails, departments) as your data processor, because DPDPA Sections 5, 6, 8(6), 12, and 13 legally require durable, auditable records of notices, consents, breach notifications, erasures, and grievances. Everything is retained under your configured retention policy (365 days by default), then permanently deleted — and we never access email content or files.

Absolutely. Non-SDF organisations still face penalties under DPDPA 2023 for inadequate security safeguards (Section 8(5) — up to ₹250 crore), failure to notify a breach (Section 8(6) — up to ₹200 crore), and failures on notice, consent, erasure, and grievance obligations (up to ₹50 crore each). Shadow AI tools are the most common vector for unintended personal data exposure.

We map each discovered AI tool against the DPDPA 2023 penalty schedule (Section 33 and the Schedule), weighting for your industry, employee count, customer record volume, and data sensitivity. The four tiers most relevant to AI tool usage are: ₹250 crore (S.8(5) — security safeguards), ₹200 crore (S.8(6) — breach notification), ₹150 crore (S.10 — Significant Data Fiduciary obligations), and ₹50 crore (S.5/S.6/S.12/S.13 — notice, consent, erasure, grievance). The output is a min–max range — actual penalties are determined by the Data Protection Board of India.

Yes. The PDF report documents your Shadow IT discovery process, risk scoring methodology, and remediation plan — all of which map to ISO 27001 Annex A.8 (Asset Management) and SOC 2 CC6.6 (Logical Access). Many customers share the report directly with auditors.