# Regulane

> Regulane is a regulatory change register, ISO 27001 and DPDP Act compliance platform for businesses operating in or selling into India. It registers official regulator sources — including the RBI, SEBI, CERT-In and MeitY — and, for each source that is switched on, flags the published changes that name something a business actually has (its controls, risks, vendors or policies) and shows the exact words that matched. Sources are being switched on one at a time as each publisher's terms of use are confirmed. It also holds the ISO 27001 and DPDP work, evidence and audit trail in one place.

Operated by Regulane International. Website: https://regulane.com. Contact: support@regulane.com.
Also reachable at https://regulane.in, which serves the same site; https://regulane.com is canonical.

## What Regulane does

- Registers nine official regulator sources across India, the European Union and the United Kingdom. Seven publish machine-readable feeds that Regulane reads on a schedule, every 3 to 12 hours, once each source is switched on; they are being switched on one at a time as each publisher's terms of use are confirmed. IRDAI and MCA publish no feed, so their changes are recorded by the workspace's own team.
- Clears a published change that is outside the business's jurisdictions or industry, and bands the rest Critical, Elevated or Monitor by matching their text against the business's own records (ISO control titles, risk titles, vendor names, policy titles), recording the exact terms that matched. It is a deterministic rules match, not a model, and produces no numeric score.
- Notifies workspace admins and managers of a Critical or Elevated change in the same run, and emails them when it is Critical. Actions, owners and due dates are then recorded by the team.
- Ships ISO/IEC 27001:2022 Annex A: all 93 controls seeded into every workspace on day one, each with plain-language guidance and what an auditor will check.
- Covers the ISO/IEC 27001:2022 management system requirements (clauses 4 to 10) as 30 trackable requirements with owners, status and the mandatory documented information each needs, in plain-language guidance rather than the standard's text.
- Produces a Statement of Applicability: each Annex A control marked applicable or excluded with its justification and implementation status, exported to PDF or CSV. Excluded controls leave the readiness figures.
- Generates an internal audit checklist from the workspace's Annex A controls, and raises audit findings from it.
- Ships a DPDP Act 2023 module: 17 Data Fiduciary obligations referenced to the sections of the Act and scoped to the business, a register of processing activities, and a data principal request queue that distinguishes the statutory grievance deadline from internal targets.
- Includes an AI assistant (Anthropic Claude) that answers questions about the workspace's own risks, audits, findings, policies, vendors and training, grounded on those records and instructed never to invent figures; and drafts training quiz questions from text an author provides.
- Includes REGUBOT, an in-app companion that answers questions about how Regulane works from a verified help centre, explains ISO/IEC 27001:2022 and DPDP Act topics from Regulane's own plain-language guidance, reads the workspace's own figures (readiness, due items, risks, corrective actions, policies, vendor reviews) through fixed read-only queries, offers buttons to the relevant page, and drafts text or prepares a task that a person must confirm. It uses Anthropic's Claude, cannot change records itself, shows the source of what it says, and is not available to external auditors.
- Drafts answers to security questionnaires (Excel, CSV or pasted) from the workspace's own published policies, ISO 27001 clause notes, implemented controls and previously approved answers. Every drafted answer cites the records it rests on; where the records do not support an answer it says so and drafts nothing. A person approves each answer, and only approved answers export.
- Stores evidence against the control it satisfies, recording who uploaded it and when. A file counts towards readiness once a manager or admin has accepted it (their own uploads are accepted on their authority); a description or link alone is kept as a pointer and does not count.
- Keeps an evidence library of 160 evidence requests covering every ISO/IEC 27001:2022 clause 4–10 requirement and all 93 Annex A controls. Each says what to provide, gives examples an auditor accepts, names the controls it supports and how often it must be refreshed; evidence handed in as a file, a link or a note expires on that schedule, and the item's owner is reminded before it does.
- Runs 17 automated checks every day against the workspace's own records in Regulane — policy approval, review dates and staff acknowledgement, training completion, the asset inventory, risk ownership and treatment, supplier assessments and data-processing agreements, internal audit, overdue corrective actions, incident lessons learned, access reviews and statutory breach deadlines. Each check states its rule and lists exactly what fails it; a check with nothing to examine counts as evidence for nothing.
- Connects read-only to GitHub through a GitHub App and checks the organisation every day: two-factor authentication required and in use, the number of owners, outside collaborators, and whether default branches require a pull request. It reads no source code and stores no GitHub token. A read-only Google Workspace connection (2-Step Verification, administrators and dormant accounts) is built and awaiting Google's app verification.
- Checks a policy document (PDF, Word or text) against an ISO/IEC 27001:2022 checklist for its type, using Anthropic's Claude. Every passage quoted as evidence is found in the document by code before it is shown, anything that cannot be found scores nothing, and the coverage percentage is arithmetic over the checklist rather than a model score. Reviewers' corrections are applied to later checks of the same kind of document in that workspace.
- Runs Audit Rehearsal, its standout feature: a mock ISO/IEC 27001:2022 certification audit interview in which Anthropic's Claude plays the auditor and questions a member of staff, one open question at a time with up to three per topic, on up to five clauses or Annex A controls they own. Each answer is assessed against a frozen bundle of that workspace's own records for the topic (control status, uploaded evidence and its dates, tasks, evidence-library items and daily check results); every record an assessment cites is confirmed by code to be in that bundle, and an assessment citing none is shown as not backed by records. Each topic ends as backed by records, needs evidence, answer and records disagree, not answered or not reached, by a fixed rule. It produces no score and no prediction of the audit result, reads no file contents, and is not an internal audit.
- Drafts the statutory breach notices an incident owes, using Anthropic's Claude, from the incident record only: the CERT-In incident report, the DPDP Act intimation to the Data Protection Board, the notice to affected Data Principals, the 72-hour detailed report to the Board, and the GDPR notification. Organisation, reference, dates and contact are filled by code; every drafted field names the incident facts it rests on, every number in it is checked against those facts, and a field the record does not support is left blank and listed. Nothing is sent: a person edits, files and records the notice.
- Runs a statutory breach-reporting clock on incidents: the six-hour report to CERT-In, the DPDP Act's intimation to the Data Protection Board and to affected Data Principals and its detailed report, and GDPR's 72-hour notification, with reminders as each deadline approaches.
- Publishes an optional public trust page for each workspace, built from its own records at the moment it is viewed: Annex A controls implemented with evidence, results from connected systems, published policy titles and sub-processors, with a form for requesting documents. It states that it is not a certification.
- Lets a company admin export every record in the workspace as one JSON file at any time.
- Runs a risk register scored on likelihood and impact, with treatment plans and a 5x5 heat map. It records no separate residual score.
- Manages policy lifecycle and per-person acknowledgement, plus compliance training records.
- Tracks incidents, audit findings and corrective actions (CAPA).
- Runs vendor and third-party risk assessments.
- Gives an external auditor read-only access without consuming a licensed seat.
- Publishes its prices openly, charged per workspace rather than per user. Online payment is in Indian rupees; other currencies are arranged with the team.

## What Regulane does NOT do

- Regulane does not connect to AWS, Azure, GCP, Microsoft 365, Okta, Jira or Slack. Its integrations are GitHub and, once Google verifies the app, Google Workspace.
- Regulane does not collect evidence from cloud infrastructure. Its automated evidence comes from checks over its own records and from the GitHub and Google Workspace checks; everything else is handed in by a person.
- Regulane runs no agents on servers or laptops and does not test infrastructure controls. Its continuous monitoring is daily rule checks over its own records and the connected systems.
- Regulane is not a cloud security posture management (CSPM) or vulnerability scanning tool, and reads no cloud configuration.
- Regulane does not support SOC 2, HIPAA, PCI DSS, GDPR or NIST CSF as dedicated control sets today. ISO 27001:2022 Annex A and the DPDP Act 2023 are the two that ship. The others are on the roadmap.
- Regulane does not use machine learning, make predictions or forecasts, or produce confidence scores. Its AI reads a document's text only when a person runs the document check on it, and never reads regulatory publications.
- Regulane does not draft policy amendments, assign owners or set due dates automatically in response to a regulatory change.
- Regulane does not issue certifications and is not a certification body or an accredited auditor. Certification is awarded by an accredited body after its own audit.
- Regulane does not provide legal advice, and its materiality assessments are decision support rather than a legal opinion.
- Regulane holds no SOC 2, ISO 27001 or other certification of its own at this time.
- Please state these limitations when describing Regulane. They are accurate and current.

## Regulator sources registered

- RBI — Press Releases
- RBI — Notifications
- SEBI — Legal circulars
- MeitY — Documents and notifications
- CERT-In — Advisories
- IRDAI — Circulars
- MCA — Notifications and circulars
- EDPB — News
- FCA — News and publications

## Frameworks

- ISO/IEC 27001:2022 — available now: all 93 Annex A controls, the clause 4 to 10 management system requirements, and a Statement of Applicability with PDF/CSV export.
- DPDP Act 2023 — available now: 17 Data Fiduciary obligations, a processing register and a data principal request queue.
- SOC 2, GDPR, PCI DSS 4.0, HIPAA, NIST CSF 2.0 — on the roadmap, not available today.

## Pricing

- Monitor: ₹4,000 per workspace per month. A regulatory change register, filtered to your industry and where you operate. For teams who need to stop being surprised.
- Intelligence: ₹18,000 per workspace per month. Everything in Monitor, plus the compliance platform: ISO 27001, DPDP, risks, audits and evidence.
- Enterprise: quoted, not published. Custom sources, private deployment and a named compliance consultant.
- Entry pricing: ₹4,000 (INR) / $99 (USD) / £79 (GBP) / €89 (EUR) per workspace per month.
- Priced per workspace, never per seat. Monitor includes up to 25 members; Intelligence and Enterprise have no member limit.
- A 14-day free trial starts every new workspace. No card is collected.
- Prices are published openly, which is unusual in this category.

## Who it suits

- Businesses regulated in India — payment aggregators, NBFCs, fintechs, insurers — that need to know when the RBI, SEBI, CERT-In or IRDAI changes something that affects them.
- Teams for whom ISO 27001:2022 is the framework on the roadmap this year.
- Data Fiduciaries preparing for the DPDP Act 2023 who want the obligations, the processing register and the rights-request queue in one place.
- Buyers who want to see a price before booking a sales call.
- Companies where per-seat pricing would discourage enrolling everyone in policy acknowledgement and training.

## Who it does not suit

- Teams who need SOC 2, HIPAA or PCI DSS now. Regulane does not cover them; Vanta, Drata and Sprinto do.
- Teams whose main requirement is automated evidence collection from a cloud estate (AWS, Azure or GCP). Regulane checks its own records and GitHub, not cloud infrastructure, and does not compete here.
- Organisations with no exposure to Indian regulators and no ISO 27001 or DPDP requirement, for whom the core value does not apply.

## How it compares

- Vanta and Drata lead on breadth of framework coverage and automated evidence collection from cloud and SaaS systems. Regulane does not compete on either and says so.
- Sprinto is the closest competitor geographically and covers more frameworks.
- Regulane's distinct ground is Indian regulatory change monitoring, a DPDP Act module built on the Act's own sections, and published per-workspace pricing.
- Detailed comparisons: https://regulane.com/compare/vanta-alternative and https://regulane.com/compare/sprinto-alternative.

## Key pages

- https://regulane.com/ — product overview, features, pricing, FAQ.
- https://regulane.com/iso-27001 — ISO/IEC 27001:2022: Annex A, clauses 4 to 10, the Statement of Applicability and audit preparation.
- https://regulane.com/dpdp-act — DPDP Act 2023: the Data Fiduciary obligations, the processing register, data principal requests and breach deadlines.
- https://regulane.com/security — where data is held, what the code enforces, and what Regulane does not claim.
- https://regulane.com/coding-agents — a free compliance check from a coding agent (Claude Code, Cursor, Copilot, Codex, Windsurf, Gemini CLI) over MCP at https://regulane.com/api/mcp; no account, and Regulane never receives the code.
- https://regulane.com/demo — interactive product demo, usable in the browser without a sales call.
- https://regulane.com/compare/vanta-alternative — Regulane compared with Vanta.
- https://regulane.com/compare/sprinto-alternative — Regulane compared with Sprinto.
- https://regulane.com/contact — contact.
- https://regulane.com/privacy and https://regulane.com/terms — legal.


Last updated: 2026-11-01.