Managed leak control for CA and tax firms that hold clients' PAN and bank files
TL;DR Driptight is data loss prevention run as a monthly service for small professional firms - CA practices, tax filers and payroll bureaus. A light agent spots client identity and bank documents leaving through personal email, desktop chat apps or pen drives, and a reviewer sends a plain monthly report. Firms pay per seat.
A ten-person CA practice can easily hold PAN cards, bank statements, salary slips and Aadhaar copies for hundreds of clients. Staff move these files through personal email, desktop chat apps and USB drives because it's quick. I couldn't find any public count of leaks from small Indian firms, and that's part of the problem. Nobody is watching.
The legal stakes have gone up though. Under the DPDP framework, failing to keep reasonable security safeguards can draw a penalty of up to ₹250 crore, and breaches must be reported to the Data Protection Board and to the people affected[1]. A firm that processes data for its clients is a data processor, while each client company stays responsible as fiduciary[1]. CERT-In also expects incidents reported within 6 hours[2].
What it does, in regulatory terms: a security tool and monitoring service only. Driptight does not make a firm DPDP-compliant by itself and gives no legal opinion. It records and limits risky file movement, and keeps an incident log the firm can use if something goes wrong.
The agent sits on office laptops and watches a short list of channels - uploads to personal email and chat sites, USB copies and printing. A small classifier trained on Indian documents recognises PAN cards, Aadhaar, Form 16, GST returns and bank statements. Rules start in "warn" mode, so staff see a prompt rather than a block, and they move to blocking only after the partner agrees. Each month a reviewer sends a one-page summary of what left, through which channel and which habit to fix.
The seed pitched AI-powered DLP for every small business. I've narrowed it, because generic DLP is crowded and small firms rarely tune it, while professional firms have the densest client data and the clearest liability.
The buyer is the managing partner of a CA, tax or payroll firm with 5–50 staff. Global DLP tools list prices from about ₹7,000 per user a year (US$72) for a basic tier[3], and that's before anyone sets them up. Driptight's own price is untested. Per-seat monthly billing with setup included is the likely model.
The DPDP Rules were notified in November 2025 with an 18-month phased rollout, so security and breach duties take full effect around mid-2027[1]. Corporate clients will start asking their accountants and payroll vendors how they protect shared files, because the client carries the fiduciary duty. That question shows up as a vendor questionnaire, and small firms will need an answer.
There's no public figure for SMB data loss prevention spend in India, and no count of leaks at professional firms. The firmer signal is regulatory - penalties of up to ₹250 crore and breach notices to every affected person[1]. Adjacent: global vendors already price DLP for small teams at US$72–144 per user a year[3], so a per-seat model clearly exists.
One Czech vendor sells DLP with published per-user pricing[3]. A Pune-based antivirus maker and a Chennai software group sell endpoint DLP in India. These are tools though. Someone in the firm still has to set up rules and read alerts, and most small practices have no IT staff at all.
The gap is a done-for-you service that knows the document types Indian firms actually handle. Fair warning, the competitor scan was limited because web search was down during research.
| Difficulty | Moderate (42/100) |
| Starting capital | ₹45–85 L |
| Time to launch | 5–8 months |
The agent is the easy part, and licensing an existing endpoint engine is an option. The hard part is tuning rules so staff aren't blocked from normal work, like emailing a client their own return. Selling also takes visits, because partners trust their peers far more than ads.
No product licence is needed. This is security software plus a monitoring service, and the duties come from data law.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
AI shouldn't decide on its own to block a file or judge whether a firm is DPDP-compliant. A person signs off on both.
Want to work out the AI layer for Driptight? Talk to Yash →
I'd call this a reasonable services business for a founder who knows both security tools and how CA firms run. If you want pure software margins then look elsewhere, because the monthly review is the product. First prove that 15 firms keep the agent running through one filing deadline.
Plan for roughly ₹45–85 L, mostly for building the agent and classifier and paying for early sales.
No product licence. You do need processor contracts under the DPDP Act, a clear staff-monitoring notice and the usual company and GST registration.
Yes. Small accounting firms everywhere hold sensitive client files. Retrain the classifier on local documents and check your own data protection law.
The free Driptight validation kit has the line-by-line capital breakdown, the effort scoring, the DPDP and CERT-In checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for firm partners, and 5 assumptions to test. Download the kit →
Thinking about building Driptight or something close to it? The make-or-break work is tuning rules so staff accept them in the middle of filing season, and I'm happy to think that through with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.