Do I need cybersecurity compliance before raising funding in India?
Key takeaways
- No certification is legally required to raise funding in India, and most investors do not ask for ISO 27001 or SOC 2 at seed stage.
- A VAPT report from the last 12 months is the single artefact technical diligence most often asks for, and it costs Rs 40,000 to Rs 1,50,000.
- The third-party risk list is the item most often found missing, because vendors holding customer data are rarely tracked in a startup.
- Under the DPDP Act 2023, investors increasingly ask how you obtain and record consent for the personal data you hold.
- Fund and seed rounds in India typically take 4 to 8 weeks of technical diligence, so have evidence ready before the term sheet, not after.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What do investors actually check during technical diligence?
Six things, in this order. Current architecture and data flow, so they can see what you hold and where. Authentication design, especially how sessions, password resets and MFA are handled, because broken access control is where breaches happen. Code and cloud hygiene, usually evidenced by MFA enforcement, short-lived credentials and no secrets in the repository. Incident response, meaning a written plan with named owners, an escalation path and a tested restore procedure. Third-party exposure, which is the list of vendors with access to production or customer data. And privacy posture, meaning what personal data you collect, the lawful basis, the retention period and the breach notification process. Certificates appear nowhere on that list; evidence does.
Is the DPDP Act 2023 relevant before I have customers?
It becomes relevant the moment you hold personal data about identifiable people, which usually includes your own users, employees and waitlist sign-ups. The Act's obligations around consent, purpose limitation, data minimisation, retention and breach notification apply to a digital personal data fiduciary, and even a small company is one. The practical work is not legal advice, it is documentation: what you collect, why, for how long, who you share it with, and how you would notify a breach. Have that as a one-page note. If you handle health, financial or children's data, the risk and the scrutiny are higher, and you should get counsel rather than a template.
What happens if diligence finds something?
Usually it becomes a condition, not a deal-breaker, but it changes your timeline and sometimes your valuation conversation. Typical findings are expired access keys, a customer database reachable from the internet, no MFA on the cloud console, or a third-party vendor with production access and no agreement. Each is fixable in days, not months, provided you have someone who can do it. The damaging outcome is not the finding itself, it is having no answer and no owner during the diligence window. Prepare a remediation plan with dates and owners, and offer the retest evidence. A startup that shows a prioritised fix list for a known issue reads as competent; one that has no answer reads as undisciplined.
Should we do a test before or after the term sheet?
Before, if you can. Testing between the term sheet and closing is normal too, but the timeline compresses, and a critical finding found two weeks before a close can stall the deal while you fix it. Sequence it like this: get a scoped VAPT done in the two weeks after the term sheet, so the report exists, then fund the top three fixes, then offer a retest within 30 days. If a buyer or a lead investor has asked for a specific questionnaire, answer it with evidence rather than with assurances, and be explicit about what is not done yet, with a date.
| Item | Evidence they expect | Typical effort |
|---|---|---|
| Independent testing | VAPT report dated within 12 months | Rs 40,000 - Rs 1,50,000 |
| Identity and access | MFA on code, cloud and admin consoles | Configuration, 2-5 engineer days |
| Incident response | Written plan, named owners, tested restore | 3-10 days plus one tabletop drill |
| Third-party risk | Current vendor list with data access and agreements | 2-5 days to build the register |
| Privacy posture | DPDP Act 2023 note: data held, consent, retention | 3-7 days of documentation work |
What are the frequently asked questions?
Get a straight answer on this
Send us the diligence questionnaire or investor checklist you received, and we will map it to a priced, dated remediation plan.
Send us the details See pricing