Flags unusual data access by staff serving their notice period
TL;DR Leaverlens reads the audit logs a company already has in its cloud office suite, its CRM and its ERP. It switches on closer watching when HR marks someone as resigning or changing role. Mid-sized Indian firms pay per employee, because long notice periods leave departing staff with full access for weeks.
Indian firms often run long notice periods, and staff keep their logins the whole way through. That's exactly when client lists, price sheets and source code walk out the door. A Pune case filed in July 2026 shows how quietly inside fraud can run - an employee is accused of diverting about ₹2.45 Cr over 20 months through fake CEO emails and edits to vendor bank details in the ERP, and finance never checked[1].
The logs that would've shown it usually exist. CERT-In has required companies to keep ICT logs in India for 180 days since 2022[2]. Nobody reads them though. Mid-sized firms with 200–2,000 staff have no security analyst, and the insider-risk products built for big enterprises cost more than their whole security budget.
Leaverlens connects to cloud audit logs through standard admin APIs, and to the HR system for one signal - who has resigned, been moved or been put on a performance plan. For everyone, it builds a quiet baseline of what each role normally touches. For people in a high-risk window, it compares their activity against that baseline, looking for bulk downloads, forwarding to personal email, new sharing links to outside addresses, odd CRM exports and edits to vendor master data. Alerts go to one named person with the evidence attached, not a dashboard of scores.
The seed proposed behavioural biometrics, meaning typing and mouse rhythms, and I reframed it. Keystroke profiling catches someone using another person's login, not a trusted employee misusing their own. It also collects sensitive data the DPDP Act will make costly to justify[3]. Audit logs answer the real question with data the company already holds.
The IT head or HR head uses it. The CFO or founder usually pays, typically after a data loss scare. A per-employee monthly fee keeps it inside a mid-sized firm's software budget, so test whether ₹100–250 per employee a month lands. Enterprise rivals don't publish prices, so anchor on what the firm lost in its last leaver incident.
CERT-In's 2022 directions made log retention normal[2]. The DPDP Act sets penalties of up to ₹250 Cr for failing to protect personal data[3], and client data taken by a leaver is exactly that kind of breach. Cloud suites have also made audit logs easy to pull through an API.
There's no public figure for Indian insider-risk spending. The closest number is vendor-sponsored - one insider-risk vendor cites an industry study's estimate of US$19.5 million (about ₹189 Cr) as the average yearly cost of insider incidents for the large firms surveyed[4]. Treat that as a vendor claim about big companies and not the size of your market.
One global SIEM vendor sells behaviour analytics with insider threat as a named use case[5]. A specialist insider-risk vendor sells risk management with pseudonymised activity data to protect employee privacy[4]. Both sell to large enterprises with security teams.
The gap is a narrow, HR-triggered product that a mid-sized Indian firm can switch on in a day.
| Difficulty | Moderate (38/100) |
| Starting capital | ₹60 L–1.1 Cr |
| Time to launch | 6–9 months |
The connectors are routine. Precision is the hard part, because a sales manager exporting the CRM before a quarterly review looks a lot like theft. Getting HR to feed status changes on time is a habit you build at each client, and no software feature will do it for you.
No sector licence is needed for Leaverlens itself. The rules that matter sit with your clients and with how you handle their staff data.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide that someone is guilty. An alert is a reason for a human to look, and any action against an employee needs a person, the evidence and HR in the room.
Want to work out the AI layer for Leaverlens? Talk to Yash →
I'd back a founder who has run security or IT at an Indian services firm and can sell to CFOs. If your plan is an all-purpose UEBA platform then avoid this one. Prove first that alerts from a single 30-day pilot lead the client to act at least once.
Plan for roughly ₹60 L–1.1 Cr, mostly on engineers who know the major office-suite audit APIs, plus a long sales cycle with CFOs.
No sector licence. You need company registration, GST once over the threshold and DPDP compliance, and your clients need monitoring clauses in their employment terms.
Yes. Audit logs and resignations work the same everywhere, but employee monitoring law varies a lot, so check your local privacy and labour rules first.
The free Leaverlens validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for IT and HR heads, and 5 assumptions to test. Download the kit →
Thinking about building Leaverlens or something close to it? The make-or-break work is keeping alerts few and right while staying on the right side of employee privacy, and that balance is worth talking through early. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.