- Home
- Ephor
Ephor
CERT-In and DPDP compliance operations, hosted and processed in India. AI agents do the continuous work. Named people at your organisation sign off.
What is Ephor?
Ephor is VinfraSec's compliance operations platform for Indian regulated organisations. AI agents do the continuous work, such as checking cloud configuration, running incident clocks and drafting regulator reports, and named people at the customer's organisation approve anything that carries liability. It is hosted and processed only in India, on AWS Mumbai with disaster recovery in Hyderabad.
VinfraSec built Ephor for the work that follows a compliance project: the 6-hour CERT-In report when an incident lands at 2 a.m., the DPDP breach intimation and 72-hour report, the evidence an auditor asks for a year later. Ephor keeps that work running, and leaves every decision that carries liability with your people.
- Covers today
- CERT-In Directions 2022; DPDP Act 2023 and DPDP Rules 2025
- Hosted in
- AWS Mumbai, with disaster recovery in Hyderabad
- AI runs on
- Amazon Bedrock India profiles (Mumbai and Hyderabad only)
- Who files
- A named person at your organisation. Ephor never submits.
- Connects to
- AWS, through a read-only role. Azure is on the roadmap.
Open an incident and every deadline starts at once
A cyber incident that touches personal data puts you on two regulators' clocks. Ephor starts them together, from the moment you log the incident.
-
CERT-In incident reportWithin 6 hours of noticing the incidentCERT-In Directions, 28 April 2022
-
DPDP intimation to the BoardWithout delay. Ephor's internal target is 6 hoursDPDP Rules 2025, Rule 7(2)(a)
-
Notice to affected Data PrincipalsWithout delay. Your team sets the internal targetDPDP Rules 2025, Rule 7(1)
-
Detailed report to the BoardWithin 72 hours of becoming awareDPDP Rules 2025, Rule 7(2)(b)
- The agent classifies the incident against all 20 incident types in Annexure I of the CERT-In Directions.
- Each report is drafted with Aadhaar, PAN, card, phone and email numbers masked.
- VinfraSec's desk is alerted an hour before each deadline and again if one passes. Your team sees every clock live in the console.
What Ephor does
Readiness scan
Assumes a read-only role in your AWS account and runs 19 checks, each mapped to a CERT-In or DPDP clause: CloudTrail, log retention and location, Object Lock, flow logs, MFA, stale keys, encryption, public access, GuardDuty, Config, and resources outside India.
Control library
19 controls mapped to CERT-In Direction and DPDP Section and Rule references. Manual controls such as NTP sync, your CERT-In Point of Contact and DPO contact are attested by an approver.
Incident clocks
The CERT-In 6-hour clock and the DPDP Board, Data Principal and 72-hour clocks start when you log an incident, with alerts swept every five minutes.
Agent-drafted reports
Classification and report text for CERT-In and the Data Protection Board, drafted with identifiers masked and held for review.
Evidence locker
Write-once storage with S3 Object Lock and a per-tenant SHA-256 hash chain anchored to locked storage, so an edited or deleted record is detected. Downloads are re-hashed before they're served.
Rights requests
DPDP Data Principal requests tracked by your own pseudonymous reference against the 90-day response window.
Audit log
Every human, agent and system action in a verifiable chain, including the model, region and redaction count for each agent action.
Desk support
On the Managed plan, VinfraSec's compliance desk watches open clocks, reviews drafts and escalates to your approver.
Who signs off
The agent drafts
Classification, report text and evidence links, held as a draft until a person acts on it.
Your approver approves
Only a person your organisation names as an approver can approve a draft, accept a risk or stand down a clock.
A person files
Someone at your organisation submits to CERT-In or the Data Protection Board and records the reference in Ephor.
Ephor never submits anything to a regulator itself. Every step is written to the audit log.
Built to stay in India
The platform that handles your incident data follows the same residency rules it helps you meet.
- Hosted in AWS Mumbai (ap-south-1), with disaster recovery in Hyderabad (ap-south-2). No CloudFront.
- IAM denies any AWS call outside India for every Ephor workload.
- AI runs only on Amazon Bedrock's India profiles, which route between Mumbai and Hyderabad.
- Aadhaar, PAN, mobile, email and card numbers are masked before any prompt leaves the application.
- Logs are kept for at least 365 days, KMS-encrypted, with CloudTrail under Object Lock.
- The AWS connector reads configuration only. Reading your data is explicitly denied.
Coverage now and next
| Area | In Ephor | With VinfraSec consulting |
|---|---|---|
| CERT-In Directions 2022 | Available now | Available now |
| DPDP Act 2023 and Rules 2025 | Available now | Available now |
| RBI technology and cybersecurity directions | On the roadmap | Available now |
| NCIIPC / CII protection | On the roadmap | Available now |
| Defence supplier security | On the roadmap | Available now |
| Cloud connectors | AWS today; Azure (Central India) on the roadmap | AWS and Azure |
Three ways to start
Readiness
One readiness scan of an AWS account and a gap review with a VinfraSec compliance specialist. Free.
Platform
Ephor run by your own team, with VinfraSec support.
Managed
Platform plus VinfraSec's desk: clock watch, draft review and approver escalation.
Pricing is scoped to your organisation. We don't publish a price list.
Questions buyers ask
Something else? Ask the assistant or book a call.
What is Ephor?
Ephor is VinfraSec's compliance operations platform for Indian regulated organisations. AI agents do the continuous work, such as checking cloud configuration, running incident clocks and drafting regulator reports, and named people at the customer's organisation approve anything that carries liability. It is hosted and processed only in India, on AWS Mumbai with disaster recovery in Hyderabad.
Which regulations does Ephor cover today?
Ephor ships with control packs for the CERT-In Directions of 28 April 2022 and for the Digital Personal Data Protection Act 2023 with the DPDP Rules 2025, plus a readiness scanner for AWS. Packs for RBI's technology directions, NCIIPC/CII protection and defence suppliers are on the roadmap, along with a Microsoft Azure (Central India) scanner. VinfraSec's consulting team covers those areas today.
Does Ephor file reports with CERT-In or the Data Protection Board?
No. Every agent output is a draft. Only a named approver can approve it, and only a person can mark a report as filed with CERT-In or the Data Protection Board of India and record its reference. Ephor never submits anything to a regulator itself.
How does Ephor handle the CERT-In 6-hour and DPDP breach deadlines?
Opening an incident starts the CERT-In 6-hour reporting clock. If personal data may be involved, Ephor also starts the DPDP clocks: intimation to the Data Protection Board without delay (Ephor's internal target is 6 hours), notice to affected Data Principals without delay, and the Board's detailed report within 72 hours. The agent classifies the incident against the 20 incident types in Annexure I of the CERT-In Directions, drafts each report, and alerts VinfraSec's compliance desk an hour before each deadline and again if it passes, while the customer's team sees every clock live in the console.
Where is Ephor's data hosted and processed?
Only in India. Ephor runs in AWS Mumbai (ap-south-1) with disaster recovery in Hyderabad (ap-south-2), uses no CloudFront, and its IAM roles deny any AWS call outside India. AI inference uses Amazon Bedrock's India geographic profiles, which route only between Mumbai and Hyderabad, and Aadhaar, PAN, mobile, email and card numbers are masked before any prompt leaves the application. Logs are kept for at least 365 days.
How does Ephor connect to our AWS account?
The customer's administrator registers the AWS account in the Ephor console, which issues an external ID. The customer then deploys a read-only IAM role in that account with the Terraform module VinfraSec provides. The role reads configuration metadata only and explicitly denies reading the customer's data.
How is Ephor different from a consent-management tool?
Consent-management tools record notices and consents. Ephor runs compliance operations: CERT-In and DPDP incident clocks together, agent-drafted reports with human sign-off, write-once evidence, rights-request tracking against the 90-day window and cloud readiness checks. Ephor is not a Consent Manager registered under Rule 4 of the DPDP Rules, and many organisations will use both.
Is Ephor an audit or a certification?
No. VinfraSec provides readiness and compliance operations, not audit opinions, certification or third-party attestation. Ephor produces the controls, evidence and audit trail that regulators, customers and independent auditors ask for.
How much does Ephor cost?
Pricing is scoped to each organisation and depends on the plan and what is in scope. The readiness scan is free. Book a call for a scoped proposal.
Start with a free readiness scan
We'll run Ephor's 19 checks against one of your AWS accounts and walk you through the gaps against CERT-In and DPDP.