Compliance is evidence, not a badge
The Digital Personal Data Protection Act asks you to demonstrate what happened to personal data, who decided it, and when. That is a record-keeping problem before it is a security problem, which is why this page describes what the platform writes down rather than what it promises.
Six mechanisms, each one testable in a sandbox tenant rather than described in a brochure.
Complete audit logs
Every workflow run, connector call, approval and configuration change writes an append-only record carrying actor, resource, timestamp and outcome. Entries are hash-chained, so an edited or removed row fails verification. An auditor sees a filterable log and can export it as signed JSONL for the retention window on your plan.
Consent-aware workflows
Each step declares the processing purpose it runs under. When consent for that purpose is withdrawn, the step halts rather than executing, and the run is marked blocked_by_consent. An auditor sees which records were skipped, under which purpose, and the consent artefact that caused the block.
Data residency
Workflow state, execution payloads and audit logs are stored in the AWS Asia Pacific (Mumbai) region, ap-south-1. Cross-region replication is disabled at the account level rather than by convention. Where a connector's own endpoint sits outside India, that destination is listed in your data map before you can enable it.
Access monitoring
Every human and machine read of customer data is attributed to a named principal and a granted scope. Sessions use short-lived tokens, and privileged actions require re-authentication. A first-seen IP range, a bulk export or an off-hours credential read raises an alert and lands in the log as escalated.
Exportable compliance reports
Generate a period report covering Data Principal request turnaround times, consent withdrawals honoured, blocked and failed runs, and each access to connector credentials. Output is a PDF alongside machine-readable CSV, with row-level references back to audit entries so a reviewer can trace any figure to its source event.
Secure data movement
Payloads travel over TLS 1.3 and rest under envelope encryption via AWS KMS, with a distinct data key per tenant. Connector secrets are redacted at write time and never reach run logs. Fields you mark sensitive are stripped from prompts before any request leaves for a model provider.
SentryFlow supplies the controls, audit trail and exports designed to support your DPDP obligations; it is not a certification and does not shift accountability, so responsibility for compliance stays with you as the Data Fiduciary.
A worked example rather than a feature list. This is the sequence a Data Principal request actually moves through, including the point where a human holds records back under a legal-obligation exemption and has to write down why.
T+0s → T+24h
- T+0sData Principal
Erasure request filed
Meghna Karunakaran opens your hosted request portal, verifies her identity by OTP, and submits an erasure request covering the mobile number and email address tied to her order history.
- T+2sSystem
Case opened and acknowledged
The platform issues case DP-2291 with a hash-chained opening entry, records which verification method was used, and returns a timestamped acknowledgement to the requester. The response clock starts on that entry.
- T+1mSystem
Identifiers located across stores
An automated scan maps both identifiers to 41 workflow runs, three connector destinations and two archived exports, listing every store that holds them and the retention basis currently applied to each.
- T+4mApprover
Scope reviewed and approved
Your data protection lead reviews the map, holds four GST invoice records under a legal-obligation exemption, and approves erasure for the remaining 37. Both decisions are recorded with a written reason.
- T+1hSystem
Erasure executed
Jobs run against the approved records, crypto-shredding the tenant data keys that protect archived payloads and issuing delete calls to each connector. Every response code is written into the case file.
- T+3hSystem
Verified, requester notified
A second discovery pass finds no remaining matches beyond the exempted invoices. The requester receives a plain-language completion notice stating exactly what was retained and the legal basis for keeping it.
- T+24hAuditor
Evidence reviewed independently
An external reviewer opens the case under read-only access, replays the hash chain to confirm no entry was altered after the fact, and exports the full file as evidence of how the request was handled.
What the platform records
This page. The audit trail, consent-aware steps, residency, and the exports an auditor can verify.
How it is built
Key management, tenant isolation, and the posture document — including an explicit list of what is not claimed.
What stays your work
Inventory, purpose, and ownership. No platform can hold these for you, so the checklist is a preparation aid rather than a product feature.
Where an obligation stays with you, these answers say so. A platform that claimed otherwise would be making a promise it has no standing to make.
Compliance
Data residency
What next
What we do not hold
No SOC 2 report, no ISO 27001 certificate, and no DPDP certification — the last of which does not exist as a thing to hold. What your reviewer gets instead is a completed CAIQ-style questionnaire, an architecture document covering key management and tenant isolation, a subprocessor list with regions, and read-only access to a sandbox tenant so the controls can be tested. If a certificate is a hard procurement gate, tell us in week one rather than at legal review six weeks in.