S Svikruti.ai
Open source now · India-first · DPDPA-focused

Privacy evidence for DPDPA, from code to launch.

Svikruti scans repositories, cloud-facing product surfaces, websites, privacy notices, and consent journeys, then turns engineering evidence into RoPA starters, vendor registers, fix tickets, SARIF, and an offline evidence workbench.

View on GitHub See what it generates
The open-source scanner is available now. A hosted edition is being explored with the privacy community.
Run locally No account required 
git clone https://github.com/chevauxenbois/svikruti.git
cd svikruti
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e '.[parsers]'
svikruti scan \
  --repo . \
  --url https://example.com \
  --privacy-url https://example.com/privacy \
  --out svikruti-report.html \
  --sarif-out svikruti.sarif \
  --ropa-out ropa.csv \
  --actions-out actions.csv \
  --vendors-out vendors.csv
Evidence Workbench Svikruti scan result
Risk level Critical
Overview Controls Actions Evidence Flow Artifacts
8 personal-data categories · 2 third parties · 15 proof-pack actions
1ScanCode, site, notice, consent
2MapData categories to controls
3FixOwner-ready tickets

Start with owner assignment, not more analysis.

Notice gaps, sensitive data, logging exposure, vendor review, and CI evidence in one place.

P0 Update privacy notice for children data
P1 Reduce contact logging exposure
P1 Complete processor register review
Evidence-first PrivacyOps

Built for the gap between legal checklists and real technical controls.

Svikruti does not pretend to certify compliance. It creates a transparent evidence pack that privacy, security, engineering, cloud, and legal teams can verify quickly.

01

Code, cloud, and website evidence

Detect personal-data signals, form fields, request bodies, storage hints, logging exposure, cookies, scripts, and third-party tools.

02

DPDPA-oriented control mapping

Connect findings to notice coverage, consent and withdrawal, data minimization, vendor governance, RoPA readiness, and children-data review.

03

Transparent review model

Each finding can carry detector ID, confidence, file or URL evidence, language, framework hints, and fields that require human confirmation.

For privacy, legal, and GRC teams

Useful because it turns product evidence into review work.

DPDPA teams need more than a questionnaire. They need proof of what is collected, where notices are weak, which processors appear, and what engineering can fix before launch.

A

Notice and purpose proof

Compare detected data categories, vendors, cookies, forms, and consent copy against privacy notice coverage and missing purpose language.

B

RoPA and processor starters

Export structured inventories with evidence references, review fields, and confirmation gaps for legal, procurement, and security teams.

C

Owner-ready remediation

Turn findings into prioritized actions and copy-ready tickets with acceptance criteria, so review ends with fixes instead of screenshots.

Launch artifact pack

One scan produces review-ready outputs.

The HTML workbench is for humans. The JSON, SARIF, CSV, and Markdown files are for CI, GRC, procurement, legal review, and engineering tickets. The Scan Quality view shows what was inspected, what was not proven, and what humans should verify.

Open demo report View sample exports
HTML Workbench

Executive posture, control board, evidence explorer, action tracker, and flow map.

SARIF

GitHub code scanning output for pull-request review.

RoPA CSV

Schema-versioned privacy inventory starter with evidence references.

Vendor CSV

Processor register starter with DPA, transfer, security, and review fields.

Fix Pack

Copy-ready GitHub, Jira, or Linear issue bodies with acceptance criteria.

AI Brief

Optional AI-assisted synthesis grounded in scanner evidence.

How it works

From repository to privacy evidence in minutes.

Run it locally, attach it to CI, or use it as the evidence layer for a future hosted PrivacyOps workflow.

1Scan

Repository, website URL, privacy notice, and optional browser consent journey.

2Classify

Personal-data categories, vendors, logging, storage, forms, cookies, and notices.

3Map

Evidence to DPDPA control areas and launch-readiness concerns.

4Export

RoPA, action tracker, vendor register, notice patch, SARIF, JSON, and fix pack.

5Gate

Use GitHub Actions to block risky privacy changes before release.

Open-source now, hosted edition being explored

Start with a free scanner. Help shape what comes next.

The priority is a useful open-source tool for India's privacy community. If teams need continuous PrivacyOps across products and releases, the hosted direction will be shaped with early users.

Free open source

For founders, privacy practitioners, and engineering teams that want DPDPA evidence quickly.

  • Local CLI scanner
  • Offline evidence workbench
  • Optional BYOK AI co-pilot
  • GitHub Action and SARIF output
  • Schema-versioned CSV and Markdown artifacts

Hosted edition under consideration

For teams that need continuous PrivacyOps across products and releases, if there is enough demand.

  • Hosted evidence vault and scan history
  • Org dashboards across many products
  • Jira, Linear, and GRC integrations
  • SSO, RBAC, audit logs, and approvals
  • BFSI, healthcare, ecommerce, SaaS, and fintech packs

Open-source now. Hosted workflows are being explored.

Use the GitHub repo today, follow the build, and help shape India-first PrivacyOps tooling for DPDPA.

Open GitHub
Get in touch

Built with love for India's privacy community.

The vision is to simplify DPDPA compliance through code, cloud evidence, technical controls, open-source workflows, and practical artifacts that teams can actually use.

Created by Harsh Kahate

Svikruti is an independent open-source effort to make DPDPA readiness more practical for Indian startups, security teams, privacy teams, and engineers.

It is not legal advice and it does not replace counsel. It is a technical evidence layer that helps teams find, discuss, and fix privacy gaps faster.

Connect on LinkedIn View GitHub

Need help with your DPDPA journey?

If you are figuring out DPDPA readiness for a product, cloud setup, website, consent flow, vendor process, or engineering release, reach out. I am happy to have a practical conversation and see where Svikruti or hands-on assistance can help.

  • DPDPA readiness conversations
  • Product, code, cloud, and website evidence review
  • Privacy notice, consent, vendor, and remediation planning
  • Open-source feedback or hosted edition interest
Open contact form
The form opens in Google Forms so inquiries stay private and easy to respond to.