A scanner finds the PAN number in your database. An auditor asks whether using it at 14:03 was covered by an active, purpose-specific consent. ScalePulse reconciles every processing event against the consent register, continuously, and keeps the evidence that stands up afterwards.
Every security tool on the market finds personal data at rest. None can say whether a given use of it was lawful, because that fact was never written to your database — it existed only in the moment your application acted.
“Was the campaign sent to this Data Principal at 14:03 on 11 March consented?”
Unknown. The column is classified and the posture is green, but no record of the event exists — nothing was watching the decision.
You reconstruct it by hand from application logs, if they are still in retention, and hope the answer is the one you wanted.
Yes. Purpose marketing.email, granted 11 March against notice signup-notice@v7, served in hi-IN.
With the consent artifact, the affirmative action that was captured, and a hash-chained trail of every state change since.
A collector runs inside your own network, introspects schemas, and classifies fields against an India-first taxonomy — Aadhaar validated by checksum, PAN by entity code, GSTIN, UPI handles, IFSC against the bank register.
Credentials stay in your secret manager. Outbound connection only.
The SDK records consent with the evidence that makes it defensible — which notice, which language, which affirmative act, at what moment — and emits purpose-bound processing events as they happen.
Consent checks are local and sub-millisecond. Safe in a hot path.
Controls evaluate against the map and the event stream. Findings deduplicate into cases, route to the team that owns the system, and carry the evidence chain that produced them.
Every suppression carries a reason, an approver, and an expiry.
Not two hundred. Each carries a parameter set signed off by counsel and reports its own precision, because a control running at twenty per cent precision is worse than no control — it spends the attention the others need.
| Ref | Control | Severity | Section |
|---|---|---|---|
| C-001 | Datastore holding personal data without encryption at rest | Critical | s.8(5) |
| C-002 | Personal data reachable from the public network | Critical | s.8(5) |
| C-005 | Personal data held outside the permitted region set | High | s.16 |
| C-006 | Processing recorded with no active consent | High | s.6(1) |
| C-007 | Processing continued after consent was withdrawn | High | s.6(6) |
| C-009 | Consent captured against a retired notice version | Medium | s.5 |
| C-010 | Notice version missing a translation for a served locale | Medium | s.5(3) |
| C-012 | Records retained past their purpose’s retention window | Medium | s.8(7) |
| C-015 | Data flow to a processor with no contract on file | Medium | s.8(2) |
| C-017 | Child-flagged Data Principal present in advertising events | Critical | s.9(3) |
| C-019 | Rights request approaching its response period | Low | s.12 |
| C-020 | Notification window milestone at risk, or missed | Critical | s.8(6) |
The Act gives every Data Principal the right to a notice in English or any language in the Eighth Schedule. ScalePulse tracks which notice version was served, in which language, to whom — and raises a finding the moment a locale is served without a published translation.
Data Principals are pseudonymised at the edge with a key held in your own KMS. We can join a consent to a processing event and prove the join — without ever knowing who anyone is. Re-identification happens only in your systems, at the moment you fulfil a request.
Outbound-only mTLS. Every payload passes an allowlist gate that drops anything not explicitly permitted, and a restricted identifier reaching that gate is a hard failure, not a warning.
Node and browser today, Python and Java next. Bounded queues, fire-and-forget writes, and a hard guarantee that it cannot break the request it sits inside.
import { ScalePulse } from '@scalepulse/sdk-node';
const sp = new ScalePulse({
apiKey: process.env.SP_API_KEY,
subjectKey: process.env.SP_SUBJECT_KEY, // hashed locally, never sent
systemId: 'checkout-api',
failOpen: true, // degrade quietly, never block
});
// Record the grant with the evidence that makes it defensible
await sp.consent.grant({
subject: user.email,
purposes: ['marketing.email'],
noticeVersion: 'signup-notice@v7',
locale: 'hi-IN',
evidence: { ip, userAgent, checkboxIds, formVersion: 'v7' },
});
// Local. Sub-millisecond. No network call.
if (await sp.consent.check(user.email, 'marketing.email')) {
await mailer.send(campaign, user.email);
}
// Or let the guard enforce it — a denial is itself evidence
await sp.guard('marketing.email', user.email, () =>
mailer.send(campaign, user.email),
);Declare a breach and a durable timer instantiates from the catalog. It survives deploys, restarts, and failover. Milestones are satisfied by artifacts, not by marking them done — and the resulting trail is the timeline you present to the Board.
Every connector declares its capabilities, so the platform tells you plainly that one can scan for retention but cannot execute an erasure — rather than discovering it when a request arrives. Dimmed entries are on the roadmap.
We are taking a small number of design partners in fintech, e-commerce, and health — sectors whose control priorities differ enough that building for the average of them would serve none of them well.