Your product passed the demo. Now it has to pass security review.

Whichever your buyers ask for by name. North American technology buyers usually ask for a SOC 2 Type II report; European, Indian and Middle Eastern buyers, tenders and regulated sectors usually ask for ISO 27001. If your pipeline is genuinely mixed, build one control set and map it to both, doing first the one your largest current buyers want. If your controls have not been running long enough to show a history, get deal-ready first — the decision helper on this page walks through it.

No — and nobody else can either, because SOC 2 is not a certification. It is an attestation report in which a licensed CPA firm gives its opinion on your controls, over a point in time (Type I) or over an observation period (Type II). What we do is the readiness work: control design against the Trust Services Criteria, the evidence trail, the penetration testing behind the technical controls and support through the audit. The same applies to ISO 27001, which only an accredited certification body can certify. A provider offering to both build and certify is offering something informed buyers will not accept.

Usually, for your customers’ data. If you process personal data on behalf of an Indian customer that decides why and how it is processed, the customer is the Data Fiduciary and you are its Data Processor. Section 8 of the Act makes the fiduciary responsible for what you do, and the DPDP Rules, 2025 expect its contract with you to bind you to reasonable security safeguards and to keep logs for a year — so expect those clauses in renewals now, ahead of the main duties in May 2027. For your own users, marketing lists and employees, you are the fiduciary. See DPDP Act compliance.

Possibly, but check the specifics with the customer. SEBI’s 2023 framework for cloud adoption, now carried into its CSCRF as Annexure J, says regulated entities may use cloud services only from MeitY-empanelled providers, and that SaaS must be built on a MeitY-empanelled provider’s infrastructure with the regulated entity’s data hosted and processed only in MeitY-empanelled, STQC-audited data centres in India. Check whether your cloud provider holds that empanelment for the region you run in, and ask the customer’s compliance team early what evidence it accepts — before you architect for it.

The RBI replaced its 2023 IT-outsourcing directions on 28 November 2025 with entity-wise “Managing Risks in Outsourcing” Directions. In the NBFC version, “service provider” includes sub-contractors, and the NBFC must audit its providers on a risk basis — it may rely on pooled audits or recognised third-party certifications, but its own responsibility is undiluted. In practice, expect audit and inspection rights over you and your sub-contractors, access to data and logs, and incident notice terms. Our RBI framework page covers what the bank itself must do.

A Type I report assesses control design at a point in time and can follow a readiness phase of a few months. A Type II report covers controls operating over an observation period, commonly several months for a first report, so the elapsed time is readiness plus the observation period plus the auditor’s reporting. That is why “SOC 2 in thirty days” offers usually mean a Type I at best. You can be deal-ready — tested, documented and answering questionnaires with evidence — long before the report arrives, and many first buyers will accept that with a dated plan.

Answer once, with evidence, and reuse. Most questionnaires ask the same things in different words, so a library of approved answers — each linked to the evidence behind it, with a date — turns a week of engineering time into an afternoon of review. The discipline that matters is expiry: an answer citing last year’s penetration test must not go out after this year’s. A public trust page answers common questions before they are asked. Questionnaire automation in SemperWise One works this way.

It can, if your product puts an AI system on the EU market or its outputs are used in the EU. The obligations depend on the system’s risk class. The 2026 amendments pushed the high-risk obligations for Annex III uses — such as employment and education — to 2 December 2027. Before any of that, buyers are already asking: the 2026 edition of the SIG questionnaire maps to ISO 42001 and asks about AI governance directly. An inventory of the AI you use and ship, with owners and risk classes, answers most of those questions. Take the legal classification of a specific feature to counsel.