Home › Legal › Audit Readiness & Regulatory Cooperation

Audit Readiness & Regulatory Cooperation Statement

We’re built for inspection. Any insurer, any regulator, any auditor — here’s how we open the books.

Digitaliiisla Technologies Private Limited operates in a regulated space (motor insurance survey, under IRDAI). We maintain documented, standing audit readiness — so insurer customers, government regulators, statutory auditors, and third-party assessors can verify our data-protection, security, and operational posture quickly and without disruption.

This page is a single reference for every audit stakeholder: who may audit, what we provide, how long it takes, and the standing cooperation commitment signed by the Board.

1. Who may audit DigiSurvey

2. What we provide during an audit

Depending on scope, the auditor receives (through a secure data-room; nothing emailed in cleartext):

• Access logs — timestamped, actor-attributed, filterable by tenant / endpoint / time window.
• Processing register (RoPA) under DPDPA 2023 — complete record of processing activities.
• Sub-processor list + their SOC 2 reports — current certifications on file.
• Breach register — every reportable incident with timeline, root-cause analysis, remediation evidence.
• Policy pack — Privacy, DPA, Security Statement, Breach SOP, Data Retention, Zero-Commercial-Use Pledge, both Data Commitments.
• Board resolutions — signatory authority, Grievance Officer appointment, DPO (if designated), security governance.
• Grievance log — DPDPA grievances received, acknowledgement time, resolution time, action taken.
• Infrastructure diagrams — data flow, encryption boundaries, tenant isolation.
• Destruction / return evidence — for insurers off-boarding, cryptographic erasure records.
• Employee security records — NDA execution, access review, background check attestation (as applicable).
• Insurance evidence — Directors & Officers (D&O) and Cyber Liability policy certificates (limits available on NDA).

3. Standing timelines

4. What we do not provide (and why)

• Other insurers’ data — strictly isolated. An insurer audit can only see that insurer’s own tenant.
• Source code (fully) — except under a specific SOW with signed NDA; limited walk-through is normal, full source dump is not.
• Live production access to auditors — evidence is produced in sanitised exports; direct database access is not granted. (Replica / staging access on request with insurer sign-off.)
• Personal information of our employees beyond what is required for the specific audit scope.
• Trade secrets — prompt engineering, ML tuning parameters, pricing analytics methodology — outside the audit scope by default.

5. Audit cost

• Insurer customer, annual, in-scope: no cost to the insurer. Our effort absorbed.
• Insurer customer, additional / incident-triggered: no cost if the incident was our fault; otherwise at reasonable cost.
• Statutory audits (IRDAI, DPBI, CERT-In, Income Tax, GST, MCA): our standing obligation; no cost sought from any party.
• Independent third-party assessor (SOC 2, ISO 27001): our cost (part of our planned certification roadmap).

6. Cross-reference to specific regulatory items

• DPDPA 2023 — our full compliance mapping is embedded in the Privacy Policy and DPA. The Record of Processing Activities (RoPA) is maintained internally and shared with regulators on notice.
• CERT-In Direction 28 April 2022 — we maintain the required 180-day log retention; synchronise clocks to NIC NTP; mandatory 6-hour incident reporting; portal registration complete In progress.
• IRDAI (Surveyors and Loss Assessors) Regulations 2015 — the Company’s survey outputs are signed off by qualified, IRDAI-licensed professionals as required under the regulations; firm-level compliance records available on request.
• Information Technology Act 2000, s.43A & SPDI Rules 2011 — reasonable security practices documented in the Security Statement; superseded by DPDPA 2023 but still a reference.
• Companies Act 2013 — statutory auditor appointment on record; books of account maintained for 8 years.
• GST Act 2017 — registered under GSTIN; monthly / quarterly returns on time.
• Income-tax Act 1961 — TDS / TCS compliance; Form 26AS reconciliation.

7. How to initiate an audit

• Insurer customers (DPA audit right): email legal@digitaliiisla.co.in with the audit scope. We acknowledge in 48 hours and share the data room within 5 business days of agreed scope.
• Government regulators: serve the notice to our registered office (Khemi Sati Road, Jhunjhunu, Rajasthan – 333001) and email a copy to legal@digitaliiisla.co.in. We will not require re-service.
• Security researchers: email security@digitaliiisla.co.in. Good-faith research under the responsible-disclosure principles is welcomed and legally safe-harboured by us.

Audit Cooperation Commitment · signed

Digitaliiisla Technologies Private Limited commits to full and timely cooperation with every lawfully constituted audit of its data-handling, security, financial, and operational practices — whether initiated by an insurer customer under contractual rights, by a government regulator under statutory authority, or by an independent assessor under our own certification programme. We will not obstruct, delay, or scope-narrow an audit beyond what is objectively necessary to protect third-party privacy or trade secrets. Any evidence sought by a competent authority will be produced completely, truthfully, and promptly.

Mrs. Monika Sharma

Director · Authorised Signatory

Mr. Vikas Saini

Director & Founder

Dated: 25 October 2026 · Jhunjhunu, Rajasthan, India

CIN U62011RJ2026PTC119030 · Registered office: Khemi Sati Road, Jhunjhunu, Rajasthan – 333001 · legal@digitaliiisla.co.in