Skip to content
Regulane
Industry firstAudit Rehearsal

Regulatory intelligence + compliance management

Know what changed.Know why it matters.Know what to do.

Regulane monitors regulatory change, flags what names something your organisation actually runs, and shows you why. Your team turns it into owned work, evidence and an audit trail, alongside your ISO 27001 and DPDP Act programme.

Start free trialExplore the product

14-day trial · No card required · Priced per workspace, never per seat · Explore the interactive demo

Regulatory Intelligence · Northwind Payments
RBI — NotificationsRBI/2026-27/118

Authentication of recurring card payments: revised framework

CriticalAction requiredEffective 1 Apr 2027

Why this was flagged

Names 2 things recorded in this workspace, in language that imposes an obligation.

  • secure authenticationISO control · A.8.5 Secure authentication
  • payment authenticationPolicy · Payment authentication
Jurisdiction
India
Published
6 Oct 2026
Effective
1 Apr 2027
Actions
2 · next due 15 Jan 2027

From change to closure

  1. Change detectedRegulane

    RBI — Notifications · original archived

  2. Materiality assessedRegulane

    Banded Critical · names 2 of your records

  3. Admins notifiedRegulane

    In the app, and by email for Critical

  4. Action recordedYour team

    Risk Operations · due 15 Jan 2027

  5. Policy reviewedYour team

    Payment authentication v3 approved

  6. Evidence acceptedYour team

    Against A.8.5 Secure authentication

Every step is written to the workspace’s audit trail, which cannot be edited or deleted.

Frameworks that ship

  • ISO/IEC 27001:202293 Annex A controls
  • DPDP Act 202317 obligations

Regulator sources registered

  • RBIIN
  • SEBIIN
  • MeitYIN
  • CERT-InIN
  • IRDAIIN · manual
  • MCAIN · manual
  • EDPBEU
  • FCAUK

9 sources from 8 regulators. 7 are read from their feeds, switched on one at a time as each publisher’s terms of use are confirmed; IRDAI and MCA publish no feed, so your team records their changes.

01The problem

The challenge isn’t finding regulations. It’s knowing which ones matter.

A payments business can be in scope for the RBI, CERT-In and MeitY at once, and each publishes every week. Most of it does not apply. Somebody still has to read all of it to find the part that does, and write down why.

Without a relevance filterEvery item read, judged and filed by handExample week
  • RBIAuthentication of recurring card payments: revised frameworkUnread · applies? · who decided?
  • CERT-InAdvisory: vulnerability in gateways used for remote workingUnread · applies? · who decided?
  • RBIAmendments to the directions on IT outsourcingUnread · applies? · who decided?
  • MeitYFrequently asked questions on the notified rules, updatedUnread · applies? · who decided?
  • RBIMonetary policy statementUnread · applies? · who decided?
  • SEBICyber resilience framework extended to registrarsUnread · applies? · who decided?
  • FCAConsumer Duty: reporting template updatedUnread · applies? · who decided?
  • EDPBGuidelines on pseudonymisation adoptedUnread · applies? · who decided?
  • and 5 more, each read the same way
With RegulaneBanded against your records, with the reason recordedSame week
  • RBIAuthentication of recurring card payments: revised frameworkCriticalNames 2 of your records, with obligation wording
  • CERT-InAdvisory: vulnerability in gateways used for remote workingElevatedNames 1 of your records, with obligation wording
  • RBIAmendments to the directions on IT outsourcingMonitorNames 1 of your records
  • MeitYFrequently asked questions on the notified rules, updatedMonitorIn scope, names none of your records
  • RBIMonetary policy statementMonitorIn scope, names none of your records
  • SEBICyber resilience framework extended to registrarsClearedSource covers capital markets, asset management, broking; this workspace is recorded as payments
  • FCAConsumer Duty: reporting template updatedClearedSource jurisdiction UK is not one of this workspace’s (IN)
  • EDPBGuidelines on pseudonymisation adoptedClearedSource jurisdiction EU is not one of this workspace’s (IN)
  1. Regulators publishCirculars, notifications, directions and advisories, every week.
  2. Little of it appliesMost is outside your jurisdiction, your industry, or names nothing you run.
  3. Teams sort it by handReading each item, judging it, and recording the decision somewhere.
  4. Regulane does the sortingEvery item banded by a published rule, with the words that decided it.

02The Regulane difference

Relevance is the product.

Regulane does not hand you more regulation. It takes away what does not apply to you, layer by layer, and shows the exact words behind everything that is left.

Example week for a payments business in India. Use the arrow keys to move between layers.

Layer 1 of 6 · All changes

Everything published

Every item from every source that is switched on, kept as it was collected, so the record survives a later edit to the regulator’s page.

  • RBIAuthentication of recurring card payments: revised framework
  • CERT-InAdvisory: vulnerability in gateways used for remote working
  • RBIAmendments to the directions on IT outsourcing
  • MeitYFrequently asked questions on the notified rules, updated
  • RBIMonetary policy statement
  • SEBICyber resilience framework extended to registrars
  • FCAConsumer Duty: reporting template updated
  • EDPBGuidelines on pseudonymisation adopted

03Regulatory intelligence engine

From a regulator’s feed to your team’s task list.

Regulatory change monitoring across 9 sources from 8 regulators. Four stages run on their own; the fifth is your team’s, and Regulane keeps the record of it.

Source registry

Feeds are read every 2 to 12 hours once switched on, and each item is archived as collected.

SourceMethod
RBI — Press ReleasesFeed · 2h
RBI — NotificationsFeed · 2h
SEBI — Legal circularsFeed · 3h
MeitY — Documents and notificationsFeed · 6h
CERT-In — AdvisoriesFeed · 4h
IRDAI — CircularsEntered by your team
MCA — Notifications and circularsEntered by your team
EDPB — NewsFeed · 12h
FCA — News and publicationsFeed · 12h

The real registry. A feed is switched on only after someone has read that publisher’s terms of use; a regulator scraped against its own terms is not a defensible source.

04From regulation to action

One RBI change, from publication to proof.

Regulane connects a change to the records it names. Your team decides what to do about it. The audit trail keeps both, so the question “what did you do about that circular?” has a one-page answer.

Regulane
runs on its own
Your team
a person decides
  1. 01Regulatory changeAuthentication of recurring card payments: revised frameworkRBI — Notifications · RBI/2026-27/118 · effective 1 Apr 2027Regulane
  2. 02MaterialityCritical names 2 of your records, with obligation wordingPayments operations are in scope: India, all industriesRegulane
  3. 03Control namedA.8.5 Secure authenticationOwned by IT Security · the change uses this control’s titleRegulane
  4. 04Policy namedPayment authentication policyOwned by Risk Operations · currently v2, last reviewed March 2026Regulane
  5. 05ActionReview the payment authentication policy against the revised frameworkAssigned to Risk Operations by your compliance lead · due 15 Jan 2027Your team
  6. 06Policy updatedPayment authentication v3, approvedApproved by the CRO · acknowledgement requested from everyone in scopeYour team
  7. 07EvidenceAuthentication configuration review, October 2026Uploaded by IT Security · accepted by a manager against A.8.5Your team
  8. 08Audit trail6 entries, each with who and whenAppend-only and chained, so an edit after the fact would showRegulane

05Investigate a change

Five questions, answered from the record.

Every change in Regulane answers the same five questions, with the regulator’s own source and the words that decided its band beside each answer.

Regulatory change · RBI/2026-27/118

What changed?

Authentication of recurring card payments: revised framework

RBI/2026-27/118. Card issuers and payment aggregators shall apply secure authentication to the first transaction of every recurring payment mandate, and shall review their payment authentication arrangements, with effect from 1 April 2027.

Kept exactly as it was collected. The archived copy survives the regulator editing or withdrawing the page.

Source
RBI — Notifications
Reference
RBI/2026-27/118
Original
rbi.org.in
Archived copy
Kept with the record

06The product

This is what you get.

Six screens from the product, shown with an example company. The same layout, the same registers, the same rules you will use on day one.

Or click through it yourself in the interactive demo

What needs attention across every module, most urgent first, and the next step to certification.

Overview
Overview
Overview
Northwind Payments · Saturday 10 October
ISO 27001 readiness
62%
57 of 92 controls done
Management system
70%
21 of 30 clause requirements
Open risks
14
3 high or critical
Regulatory changes
1
1 critical this week
Overdue obligations
2
6 due within 14 days
Vendor reviews due
3
18 vendors tracked
Needs attention
Most urgent first, across every module
  • NewCritical change: Authentication of recurring card payments: revised frameworkRegulatory change · RBI
  • 3d overdueAccess review for production systemsEvidence · A.5.18 · IT Security
  • Due in 4dSupplier assessment: card processorVendor review · Risk Operations
  • Due in 9dRespond to data principal request DPR-0042DPDP request · Privacy
  • Due in 12dCorrective action CAPA-007: log retentionCAPA · IT Security
Next step to certification
Step 6 of 9 · finish these in order
5/9
Run your internal audit

Generate the checklist from your Annex A controls, record what you find, and raise findings from it.

07Compliance management

Regulatory intelligence tells you what changed. Compliance management helps you do something about it.

15 modules in four groups. Monitor is the regulatory half; Intelligence adds the operational half: the controls, the evidence and the audit. A trial includes all of it.

Regulatory intelligence

What changed, whether it names something you run, and the work it leads to.

  • Regulatory IntelligenceAll plans

    Changes from registered regulator sources, banded against your own records, with the exact words that matched.

  • Compliance AssistantIntelligence

    Questions about your own risks, audits, findings, policies and vendors, answered from those records.

  • Audit RehearsalIntelligence

    A mock certification interview for each control owner, checked against your records.

Compliance

The frameworks, the evidence that proves them, and the documents behind them.

  • ISO 27001Intelligence

    Annex A controls, clauses 4–10, the Statement of Applicability and readiness.

  • DPDP ActIntelligence

    Data Fiduciary obligations, the processing register and the request queue.

  • EvidenceIntelligence

    The evidence library and the daily checks over your records and GitHub.

  • DocumentsAll plans

    Versions, approvals, attestations, sharing and disposal on every file.

  • Policies & TrainingIntelligence

    Publish a policy, collect acknowledgements, record training.

Risk & assurance

Risks, audits, incidents and suppliers, each with its own trail.

  • Risk ManagementIntelligence

    The register on likelihood and impact, owners, treatment plans and a heat map.

  • Audits & CAPAIntelligence

    Internal audits, findings, root cause and the corrective actions that close them.

  • IncidentsIntelligence

    Report and investigate, with a statutory breach clock and drafted notices.

  • VendorsIntelligence

    Supplier assessments and tiering, with the documents each vendor has given you.

Operations

The day-to-day: who owes what, by when, and who opened what.

  • OverviewAll plans

    What needs attention across every module, most urgent first.

  • Tasks & CalendarAll plans

    Every task, owner and due date in one calendar.

  • Access LogsAll plans

    Who signed in, from where, and what they opened.

08ISO 27001:2022

ISO 27001, from the first control to the certification audit.

Every workspace opens with the whole standard loaded, written in plain language, with what an auditor will check against each control.

  • All 93 Annex A controls on day oneStatus, maturity, owner and evidence against each, with guidance on what an auditor accepts.
  • Clauses 4–10 as 30 requirementsThe management system an auditor tests first, with the mandatory documented information each needs.
  • Statement of ApplicabilityEach control applicable or excluded with its justification, exported to PDF or CSV. Excluded controls leave the readiness figure.
  • Readiness you can defendA control counts only when it is complete, at maturity 3 or more, evidenced, and has no failing check.
  • Audit preparationAn internal audit checklist generated from your controls, and Audit Rehearsal before the real interview.
Everything Regulane does for ISO 27001
ISO 27001 · Readiness · Northwind Payments
Organizational26/37
People6/8
Physical9/14
Technical16/34
Statement of ApplicabilityExport PDF · CSV
ControlImplementation or justification
A.7.4Physical security monitoringImplemented
A.8.5Secure authenticationIn progress
A.7.14Secure disposal or re-use of equipmentImplemented
A.8.30Outsourced developmentNo software development is outsourced
Evidence library: 160 requestsDaily checks: 17Auditor access: read-only, no seat used
DPDP Act · Northwind Payments

Scope

  • Significant Data Fiduciary
  • Processes children’s data
  • Transfers data outside India

17 Data Fiduciary obligations, each referenced to its section of the Act; the scope switches which apply.

Data principal requests

  • DPR-0042 Erasure
    Received 1 Oct · Internal target 15 Oct
  • DPR-0041 Access
    Received 28 Sep · Answered 3 Oct
  • DPR-0039 Grievance
    Received 19 Sep · Statutory limit 18 Dec · Rule 14(3)

Processing register

12 purposes · data, lawful basis, recipients, retention

Breach clock

Board intimation, notice to people affected, 72-hour report

09DPDP Act 2023

The DPDP Act, as work you can track.

For Data Fiduciaries getting ready for the Act: the obligations that apply to you, the register behind them, and the deadlines that come with them.

  • 17 obligations, scoped to youReferenced to the sections of the Act, and switched on by your scope: significant data fiduciary, children’s data, transfers abroad.
  • A register of processing purposesEach purpose with the data it uses, its lawful basis, who receives it and how long it is kept, and the gaps the Act cares about.
  • Data principal requests with real deadlinesA grievance carries the 90-day outer limit set by Rule 14(3); other requests run to your own targets, and every due date says which it is.
  • Breach reporting deadlinesThe intimation to the Data Protection Board and to the people affected, and the detailed report, on a clock, with drafted notices.
  • Changes from MeitYMeitY is a registered source, so a change to the rules arrives in the same register as everything else.
All 17 obligations, referenced to the Act

Decision support, not legal advice. Confirm how the Act applies to you with your adviser.

10Risk, audit and evidence

One operating system for audit readiness, not six separate registers.

A gap shows up the day it opens, travels through the audit as a finding, and closes only when somebody other than the person who fixed it says it is fixed. Every step is on the record.

  1. 01 Control

    A.5.18 Access rights

    Owned by IT Security, marked in progress at maturity 2.

    In progressYour team
  2. 02 Evidence

    EV-014 Access review records

    The last review on file, collected 14 March, has expired on its schedule.

    ExpiredYour team
  3. 03 Daily check

    An access review in the last six months

    Fails, and names the record it fails on, the day the gap opens.

    FailingRegulane
  4. 04 Internal audit

    Checklist item A.5.18 tested

    From a checklist generated from your Annex A controls.

    TestedYour team
  5. 05 Finding

    F-01 Reviews not at the defined frequency

    Raised from the checklist item, graded major.

    MajorYour team
  6. 06 CAPA

    Root cause and corrective action

    Quarterly reviews scheduled as tasks with an owner; the July review is uploaded.

    CompletedYour team
  7. 07 Closure

    Verified and closed

    By a manager who neither did the work nor is assigned it, with an effectiveness rating.

    ClosedYour team

Risk register

Likelihood and impact on a 5×5, owners, treatment plans, and a daily check that every open high risk has one.

Incidents

Report and investigate, with a breach clock for CERT-In, the DPDP Act and GDPR deadlines, and a daily check that every closed incident records its lessons learned.

The evidence library

160 requests covering every clause and control, each with an owner and a refresh date, and 17 checks run daily.

11AI inside the workflow

AI where every answer can be checked against your records.

Anthropic’s Claude does specific jobs inside specific screens. Each one cites the records it used, and code confirms those records exist before you see the result.

Industry firstAudit Rehearsal

Rehearse the certification audit before the auditor arrives.

Audits are lost in interviews: someone says access is reviewed every quarter, and the last review on file is seven months old. Audit Rehearsal puts an AI auditor in front of each control owner first.

  • Interviews each person on the clauses and controls they own, one open question at a time, with follow-ups when an answer is vague.
  • Checks each answer against your records: control status, evidence and its dates, tasks and the daily check results.
  • No score and no pass prediction. Each topic ends as backed, needs evidence, or answer and records disagree, by a fixed rule.
Example rehearsal · A.5.18 Access rights
Auditor

When were access rights to the production systems last reviewed, and what would you show me?

Control owner

We review everyone’s access every quarter. The last one was a few weeks ago.

Answer and records disagree

The latest access review on file (R4) was collected on 14 March 2026 and has expired. An auditor would ask for the reviews since then.

Based on 1 record (R4) · confirmed to exist

Auditor

Who carried out the March review, and what changed as a result of it?

  • Breach notices, drafted

    Incidents

    The CERT-In report, the DPDP intimation to the Board, the notice to the people affected and the 72-hour report, drafted from the incident record only. Every figure is checked against it; nothing is sent for you.

  • Document check

    Documents

    A policy checked against an ISO 27001 checklist for its type. Every passage quoted as evidence is found in your document by code before it is shown.

  • Questionnaire answers

    ISO 27001

    Security questionnaires drafted from your published policies, controls and approved answers. Where your records do not support an answer, it says so and drafts nothing.

  • Compliance Assistant

    Intelligence

    Questions about your own risks, audits, findings, policies, vendors and training, answered from those records, and told never to invent a figure.

  • Workspace analysis

    Overview

    Observations, priorities, gaps, a risk summary and audit readiness, read from the whole workspace on request.

What the AI never does

  • Reads regulatory publications or decides what is relevant. That is a published rule.
  • Produces a score, a prediction or a confidence figure.
  • Sends, files or approves anything on your behalf.
  • Shows a quotation or a citation that code has not confirmed exists.

* Industry first: as of October 2026 we found no other compliance platform that rehearses the certification audit interview and checks each answer against the customer’s own records. If you know of one, tell us and we will correct this. AI features use Anthropic’s Claude and are included in the Intelligence plan. Drafts are not legal advice.

12Security and trust

Built so the evidence is already there when someone asks.

None of this is impressive on a slide. It is what an auditor, a customer’s security team and the DPDP Act ask to see.

Application servers
Singapore
Workspace database
United States, AWS us-east-1
In transit
TLS, browser to server to each provider

Regulane holds no SOC 2 or ISO 27001 certification of its own yet; we will say so here until it does. Every processor we use is named in the privacy notice.

Read the full security page

  • Tenant isolation

    Every record is scoped to your workspace, and the scope is checked on every request on the server.

  • Private file storage

    Documents and evidence are stored privately and reached through short-lived links. Each read is logged.

  • Access logs

    Who signed in, from where, and what they opened: the trail an assessor asks for.

  • An audit trail that cannot be edited

    Append-only and hash-chained. Free text is kept as its length and a fingerprint, so personal data can still be erased from the record itself.

  • Separation of duties

    Destroying a document needs a second approver, and a corrective action is verified by someone who did not do it. Enforced on the server, not in the browser.

  • Evidence history

    Who uploaded each file, when, and who accepted it. A description or link alone never counts as evidence.

  • Two-step verification

    Authenticator apps with recovery codes, held by Regulane, available to every account.

  • Take everything with you

    An admin can export every record in the workspace as one file at any time; registers export to PDF and CSV.

13Where Regulane is different

Most compliance platforms start from a framework. Regulane starts from what changed.

Both approaches end in evidence an auditor accepts. The difference is whether your programme notices when the rules move underneath it.

Starts from
Framework-firstA framework’s list of controls
RegulaneWhat regulators published this week
First question
Framework-firstAre we compliant with the framework?
RegulaneWhat changed, does it matter to us, and what do we do?
Relevance
Framework-firstDecided by whoever reads the circular
RegulaneDecided by a published rule, with the words that matched
The trail
Framework-firstEvidence collected for the audit
RegulaneWhat changed → why it matters → what we did → the evidence
Strongest at
Framework-firstCloud integrations, SOC 2, HIPAA, PCI DSS
RegulaneIndian regulatory change, ISO 27001, the DPDP Act

If you need SOC 2 or automated evidence from AWS, Azure or GCP today, a framework-first platform is the better fit, and our comparison pages say so.

Regulane vs VantaRegulane vs Sprinto

14Pricing

One price per workspace. Never per seat.

Compliance only works when everyone is in it, so the price does not grow with your headcount. Monitor includes up to 25 members; Intelligence and Enterprise have no member limit at all.

Monitor

A regulatory change register, filtered to your industry and where you operate. For teams who need to stop being surprised.

₹4,000
per workspace / month
Start free trial
Members
25
Storage
25 GB
  • Regulatory change register for nine registered regulator sources: seven read from their feeds as each publisher’s terms are cleared, and two with no feed (IRDAI, MCA) added by hand
  • Changes outside your industry or jurisdictions cleared, with the reason recorded; everything else kept in the register
  • Critical and Elevated banding needs the controls, risks, vendors and policies kept in Intelligence; any you added during the trial still count
  • Change register with links to the original source
  • Document management with versions and attestations
  • Public trust page for your customers
  • Up to 25 members
  • 25 GB of document storage
  • Email support

Intelligence

Full platform

Everything in Monitor, plus the compliance platform: ISO 27001, DPDP, risks, audits and evidence.

₹18,000
per workspace / month
Start free trial
Members
Unlimited
Storage
250 GB
  • Everything in Monitor
  • Audit Rehearsal: mock audit interviews checked against your records (AI)
  • ISO 27001:2022 — all 93 Annex A controls
  • DPDP Act obligations, processing register and request queue
  • Evidence library: 160 requests with owners and refresh dates
  • Daily automated checks on your records, and GitHub
  • ISO 27001 document check and questionnaire answering (AI)
  • Risk register with treatment plans
  • Audits, findings and CAPA
  • Incidents with a breach-reporting clock and AI-drafted CERT-In and DPDP notices
  • Vendors and training
  • Unlimited members
  • 250 GB of document storage
  • Priority support

Enterprise

Custom sources, private deployment and a named compliance consultant.

Custom
Scoped to your estate
Contact sales
Members
Unlimited
Storage
Unlimited
  • Everything in Intelligence
  • Custom regulatory sources
  • Private deployment
  • Unlimited members and storage
  • Named compliance consultant
  • Custom workflows and SLAs
  • 14-day trial on every plan · no card
  • Per workspace. Never per seat.
  • Billed in INR, paid online

Interactive demo

Use the product before you talk to anyone.

A working replica of the dashboard, running in your browser on an invented company. One short form first; a call is offered at the end, never required.

Explore the interactive demo
  1. 01Record an action on a regulatory changeOwner and due date against the change itself.
  2. 02Attach evidence to an ISO controlAnd watch readiness recalculate, because it is calculated, not drawn.
  3. 03Treat a riskThe untreated count falls on the overview.
  4. 04Publish a policyCollect acknowledgements and see who has not.

15Questions

Straight answers, including the limitations.

What Regulane does not do is written down as plainly as what it does. Anything not covered here goes to a person, not a form.

The product

What does Regulane do?

Regulane registers the regulators that publish the rules you have to follow and, for each source that is switched on, flags the published changes that name something your business actually has: your controls, risks, vendors or policies. Each flag shows the exact words that matched. Sources are being switched on one at a time as each publisher's terms of use are confirmed. Underneath it is a compliance platform for ISO 27001 and the DPDP Act: controls, evidence, risks, incidents, audits and policies.

What is Audit Rehearsal?

Regulane's standout feature. An AI auditor (Anthropic's Claude) interviews each member of staff on the ISO 27001 clauses and Annex A controls they own, one question at a time, and checks every answer against the workspace's own records: control status, evidence and its dates, tasks and the daily check results. Each assessment names the records it rests on and Regulane confirms each one exists, so people find out where what they say and what they can prove part ways before the certification audit does. It gives no score and no pass prediction. For incidents, the same AI drafts the CERT-In six-hour report and the DPDP Act breach notices from the incident record, with every figure checked against it.

How is Regulane different from Vanta and Sprinto?

Vanta and Drata lead on framework breadth and automated evidence collection, and Sprinto is the closest competitor in India. Regulane does not compete on integrations or framework count. What it does that they do not is cover Indian regulators — the RBI, SEBI, MeitY, CERT-In, IRDAI and the MCA — and flag the published changes that name something your business has, with a DPDP Act module built on the Act's own sections. It also publishes its prices, per workspace rather than per seat.

How quickly does Regulane detect a regulatory change?

Once a source is switched on, its feed is checked every 3 to 12 hours, depending on how often that regulator publishes. A new item is read, banded for materiality and, if it is Critical or Elevated for you, your workspace admins and managers are notified in the same run, by email when it is Critical. Your team then records the actions and owners.

Coverage

Which compliance frameworks does Regulane support?

Two today. ISO 27001:2022: all 93 Annex A controls seeded into every workspace on day one, the clause 4-10 management system requirements, and a Statement of Applicability you can export. And the DPDP Act 2023: 17 Data Fiduciary obligations, a processing register and a data principal request queue. SOC 2, GDPR, PCI DSS, HIPAA and NIST CSF 2.0 are on the roadmap.

Which regulators does Regulane cover?

Nine sources across India, the European Union and the United Kingdom: the Reserve Bank of India, SEBI, MeitY, CERT-In, IRDAI and the Ministry of Corporate Affairs, plus the European Data Protection Board and the UK Financial Conduct Authority. Seven publish feeds that Regulane reads automatically once each source is switched on; they are being switched on one at a time as each publisher's terms of use are confirmed. IRDAI and the MCA publish no feed, so your team records their changes.

Does Regulane help with the DPDP Act 2023?

Yes. The DPDP module sets out the Data Fiduciary obligations as 17 controls referenced to the sections of the Act, switched on or off by your scope (significant data fiduciary, children's data, cross-border transfer). It includes a register of processing activities and a queue for data principal requests, which shows the statutory grievance deadline separately from targets you set yourself. DPDP-related changes published by Indian regulators also come through regulatory monitoring. It is not legal advice.

Pricing and trial

How much does Regulane cost?

Monitor is Rs 4,000 per workspace per month and Intelligence is Rs 18,000 per workspace per month. Enterprise is quoted. Pricing is per workspace, never per seat. Monitor includes up to 25 members; Intelligence and Enterprise have no member limit.

Is there a free trial?

Yes. Every new workspace starts on a 14-day free trial, and no card is collected.

Does Regulane charge per user?

No. Regulane is priced per workspace. Monitor includes up to 25 members and Intelligence has no member cap, and an external auditor gets read-only access without taking a seat.

Integrations, AI and limits

Does Regulane connect to AWS, GitHub or other tools to collect evidence automatically?

Partly, and the boundary is exact. Regulane connects read-only to GitHub, through a GitHub App that reads no source code, and checks two-factor authentication, owners, outside collaborators and branch protection every day; a Google Workspace connection is built and awaiting Google's verification. It also runs 17 daily checks over your own records in Regulane, such as policy approvals, training completion, supplier assessments and overdue corrective actions. It does not connect to AWS, Azure, GCP or any other cloud infrastructure and reads no cloud configuration. Everything else is handed in by a person against the evidence request it answers, and Regulane records who and when. If automated evidence collection from a cloud estate is the main thing you are buying, Vanta, Drata and Sprinto do that and Regulane does not.

Does Regulane use AI?

In three places, and narrowly, all built on Anthropic's Claude. An assistant answers questions about your own risks, audits, findings, policies, vendors and training, and can draft training quiz questions from text you provide. It drafts answers to security questionnaires from your published policies and records: every answer cites the records it rests on, a question your records do not cover is left blank, and nothing is exported until a person approves it. And it checks a policy document you submit against an ISO 27001:2022 checklist for that kind of document: every passage it quotes is found in your document by code before it is shown, and the coverage percentage is arithmetic over the checklist, not a model score. All three are grounded on your records and instructed never to invent figures. Regulane uses no machine learning, makes no predictions or forecasts, and produces no confidence scores. Regulatory materiality is a transparent rules match, not a model.

Can Regulane get my company SOC 2 compliant?

Not today. ISO 27001:2022 and the DPDP Act are the frameworks Regulane ships. SOC 2 is on the roadmap. Regulane is also not a certification body — certification is awarded by an accredited body after its own audit, and no software can issue it.

Is Regulane a cloud security posture management or vulnerability scanning tool?

No. Regulane reads no cloud configuration, runs no agents and performs no vulnerability scanning. Its continuous monitoring is daily rule checks over its own records and connected GitHub accounts, not testing of infrastructure. It is a regulatory change monitoring, ISO 27001 and DPDP compliance platform.

Regulation changes every week. Your compliance programme should know what changed, and what to do next.

Start free trialExplore the demo

14-day trial · No card required · Per workspace, never per seat