DPDP Compliance

Effective 28 June 2026 · operated by Krutrim SI Designs Private Limited (a Krutrim group company)

This statement explains how Krutrim Ekam aligns with India's Digital Personal Data Protection Act, 2023 (DPDP Act). Ekam is an agent-identity & delegation control plane: it processes a minimal set of personal data, and is built so that you — our customer — can meet your own DPDP obligations across the agents you run.

1. Data Fiduciary

Krutrim SI Designs Private Limited (a Krutrim group company) is the Data Fiduciary for personal data processed through Ekam's own service. Registered office: 8th Floor, Wing C, Prestige RMZ Startech, Block C, Industrial Layout, Hosur Road, Koramangala, Bengaluru, Karnataka 560095. GSTIN 29AAKCK1411A1Z1.

2. Personal data we process — and what we don't

• We process: for human sign-in (Google OIDC) — your name, email address and Google account identifier, requested under the openid, email and profile scopes only; plus security/audit logs of authentication and administrative actions.
• We do not process: any other Google data, no passwords, no special-category data, and no children's data (Ekam is a B2B service not directed at children). Agent identities, blueprints and token metadata are operational records, not personal data of a Data Principal.

3. Lawful purpose & consent (§5–6)

We process your personal data for the specified, lawful purpose of authenticating you and operating the service for your organization. For human sign-in this rests on your consent, captured at the Google consent screen and limited to the minimum scopes above. You may withdraw consent at any time (§6(4)) by ceasing to use the service and requesting erasure.

4. Data minimization & purpose limitation (§6)

We collect only what is necessary to authenticate and operate, retain it only as long as needed, and never use it for an incommensurate purpose. Website analytics are cookieless and non-identifying (see Privacy).

5. Your rights as a Data Principal (§11–14)

• Access — a summary of your personal data and how it is processed (§11).
• Correction & erasure — correct or erase your personal data (§12). Most identity data is sourced live from your Google account; on erasure we delete your Ekam human record and prune associated audit references subject to applicable retention law.
• Grievance redressal — raise a grievance with us first (§13); we respond within statutory timelines.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity (§14).

To exercise any right, contact legal@olakrutrim.com.

6. Security safeguards (§8(5))

• Tokens are short-lived, audience-bound and scoped; signing keys are asymmetric (ES256), verified offline via JWKS.
• A kill-switch with real-time CAEP push revokes an identity and all its live tokens immediately.
• Tenant/entity isolation, role-gated administration, and append-only audit logs of authentication and admin actions.
• Data in transit is TLS-encrypted; secrets are held in protected stores, never in code or logs.

7. Data localization & resilience

Personal data is stored and processed on Krutrim Cloud, in India. The service runs with high availability and cross-region disaster recovery (primary in Hyderabad, standby in Bengaluru), so your data and access survive a regional outage.

8. Retention (§8(7))

We retain personal data only while your account is active or as required to provide the service and meet legal, security and audit obligations, after which it is deleted or anonymized.

9. Personal data breach (§8(6))

In the event of a personal data breach we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and its rules.

10. How Ekam helps you meet DPDP

Ekam is itself a compliance tool for your AI estate: every agent has an owned, auditable identity tied to a human principal; access is least-privilege and time-boxed (including one-time JIT elevation); revocation is immediate and pushed; and a complete, queryable trail of which principal accessed which resource supports your access, correction and erasure obligations across the agents you run.

Contact

Grievances and Data Principal requests: legal@olakrutrim.com. We will update this statement as the DPDP Rules are notified.

We may update this document; the effective date above reflects the latest version. Questions: contact legal@olakrutrim.com.