Code-aware discovery
Scans source code, web surfaces, OpenAPI/schema files, Kubernetes/IaC signals, notices, and consent traces to find privacy-relevant evidence.
Open source privacy engineering for India
Svikruti turns DPDPA readiness into engineering evidence.
A local-first PrivacyOps workbench that scans code, websites, notices, cloud and security signals, vendors, and consent surfaces, then turns them into actions teams can review before a release.
DPDPA
PrivacyOps
SARIF
RoPA
AI-ready evidence
Local-firstNo hosted upload required for the open-source workflow.
Multi-signalCode, web, notices, controls, vendors, breach readiness.
Review-readyDashboard, HTML, JSON, SARIF, CSV, Markdown fix packs.
AI-nativeOptional synthesis grounded in scanner evidence.
Why it exists
DPDPA compliance should not stop at policies and screenshots.
Most compliance work becomes a tracker of manual statements: policy exists, screenshot attached, owner says done. Svikruti takes a different approach. It starts from the systems that actually process data, then creates a trace from source evidence to privacy obligation, control posture, and remediation.
The goal is not to replace legal review. The goal is to give privacy, security, product, and engineering teams a shared evidence layer they can inspect, challenge, and improve.
Technical controls
Connects DPDPA readiness to encryption, secret hygiene, logging risk, vulnerability management, monitoring, backup, and incident response evidence.
AI-native evidence
Produces structured evidence packets that an AI reviewer can summarize without inventing facts outside the scanner results.
Local-first posture
Runs on your machine by default. Teams can inspect results without sending repositories or sensitive evidence to a hosted scanner.
Workflow
One scan, many review surfaces.
01Scan
Repository, website, notice, consent path, schema, cloud and security evidence.
02Map
Connect personal-data categories to source files, systems, vendors, and notice coverage.
03Control
Score technical controls such as encryption, monitoring, secrets, vulnerability management, and incident readiness.
04Gate
Convert high-risk evidence into release decisions, owners, priorities, and acceptance criteria.
05Export
Generate artifacts for humans, CI, GRC workflows, procurement, legal review, and AI synthesis.
Product surface
A dashboard for privacy programs that need engineering proof.
Use the local dashboard during release review, audit preparation, vendor checks, or breach readiness conversations. It is designed to show what was found, what is weak, what needs an owner, and which artifacts can be exported.
Launch artifact pack
Outputs that match how teams actually work.
Local dashboard
A review cockpit for risk, control posture, breach readiness, evidence search, and AI-ready summaries.
HTML evidence pack
A portable report for privacy, security, legal, product, and engineering review without uploading code.
SARIF
GitHub code scanning output so privacy and security findings can show up in pull-request workflows.
RoPA CSV
A starter processing inventory with data categories, purposes, owners, systems, vendors, and evidence references.
Vendor CSV
Third-party and processor register starter with DPA, transfer, safeguards, review, and ownership fields.
Fix pack
Copy-ready issue bodies for GitHub, Jira, or Linear with priority, owner hints, acceptance criteria, and evidence links.
Quickstart
Run it locally, inspect the evidence, then decide what to fix.
Start with the realistic example pack, then point the scanner at your own repository. The open-source flow keeps the scan local and generates review artifacts you can share intentionally.
git clone https://github.com/chevauxenbois/svikruti
cd svikruti
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .
svikruti scan --repo examples/realistic --save-history
svikruti dashboardOpen source now
Built for builders, privacy teams, and reviewers.
The community version is meant to stay useful on its own: local scans, dashboard, evidence packs, export formats, and CI-friendly outputs.
Enterprise direction
Continuous PrivacyOps across products and releases.
Hosted evidence vault, scan history, org dashboards, SSO/RBAC, approvals, Jira/Linear/GRC integrations, and domain packs for BFSI, healthcare, ecommerce, SaaS, and fintech teams.
Build in public
Use it, star it, break it, improve it.
Svikruti is my attempt to make DPDPA readiness more practical for India's privacy community: less theatre, more evidence, more open-source tooling.