Write-once log storage in India for firms that must keep 180 days of logs
TL;DR Logkeel picks up firewall, server, email and cloud logs from mid-size Indian companies and stores them in India in a form nobody can edit or delete until the retention period ends. When something goes wrong, the firm can hand CERT-In or an investigator a clean, time-stamped record. Customers pay a monthly fee based on data volume.
Since June 2022, almost every Indian company has had to log activity on all its IT systems and keep those records in India for a rolling 180 days. The same directions say listed cyber incidents must reach CERT-In within 6 hours[1]. Ignore them and you're looking at up to a year in prison or a fine of up to ₹1 lakh, though enforcement has been pretty light so far[2].
Here's the catch - many mid-size firms keep their logs on the very servers an attacker gets to first.
Ransomware crews and dishonest insiders delete or tweak logs to cover their tracks, and then the company has no way to show what happened, which hurts a lot more now that the DPDP Rules require breach notices[3].
What it does, in regulatory terms: record retention and evidence support only. Logkeel is not a CERT-In empanelled auditor and it doesn't report incidents for the client. It keeps the records the client needs to report on time.
A small collector inside the network forwards logs from firewalls, VPNs, servers, office suites and cloud accounts. Logkeel stamps each batch with a hash and an NTP-synced time, then writes it to storage in an Indian region with a write-once lock that even the root account can't lift until retention ends[4]. A simple dashboard shows which sources have gone quiet, which is the most common gap by far. One button produces an export for CERT-In or a forensic firm.
The seed talked about "temporal breach risk" and immutable storage in general. I've pinned it to one concrete legal duty, keeping logs for 180 days in India, because that gives you a named buyer and a deadline.
The buyer is the IT head or the CFO at companies with 50–500 staff - manufacturers, hospitals, NBFCs, logistics firms and software exporters. Few of them run a security operations centre, and the big SIEM suites are priced for much bigger teams. Logkeel's price is untested. A monthly fee by gigabytes ingested, with a floor, is the likely model.
Three things line up. CERT-In's 180-day rule has applied since 27 June 2022[2]. The DPDP Rules, notified in November 2025, phase in over 18 months and carry penalties of up to ₹250 crore for weak security safeguards[3]. And cloud object storage with compliance-grade write-once locks is now a standard building block, so the storage itself is cheap[4].
There's no public figure for what Indian companies spend on log retention. The directions cover service providers, intermediaries, data centres, body corporates and government bodies, which is almost every registered company[1]. An adjacent signal - big vendors now market tamper-proof, hashed log storage aimed at Indian rules like SEBI's cyber framework[5].
One Chennai-based software group's log tool offers configurable retention with encrypted, hashed and timestamped logs[5]. Firms with cloud skills can set up a cloud provider's write-once storage lock themselves[4]. Managed security providers sell full SOC services.
What's missing is a done-for-you vault for firms that want proof of retention without buying a full SIEM or SOC contract. Fair warning though, the competitor scan was limited because web search was down during research.
| Difficulty | Moderate (43/100) |
| Starting capital | ₹50–90 L |
| Time to launch | 6–9 months |
Storage is the easy bit. The real work is collection - dozens of log formats, firewalls that quietly stop sending syslog and customers who forget to add new servers. Your own security also has to be excellent, because a log vault is a juicy target.
No sector licence is needed to sell log storage. The rules that matter are the ones your buyers already carry.
Don't call the service a CERT-In audit. You aren't empanelled.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide what counts as a reportable incident or edit a stored log. Those calls belong to the client and the record has to stay untouched.
Want to work out the AI layer for Logkeel? Talk to Yash →
I think this is a sensible, narrow business for a founder with security operations experience and links to IT resellers. If you're hoping to sell it purely online then it's a weak fit. First prove that ten firms will pay a monthly fee and keep every log source flowing for 60 days.
Plan for roughly ₹50–90 L, mostly for engineering, cloud storage in India and the first sales hires.
No sector licence. You need company registration and GST, and you must build to the CERT-In directions and act as a DPDP processor for each client.
Yes. Most countries have their own log retention or breach-reporting rules, so map the product to your local regulator before you sell.
The free Logkeel validation kit has the line-by-line capital breakdown, the effort scoring, the CERT-In and DPDP checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for IT heads, and 5 assumptions to test. Download the kit →
Thinking about building Logkeel or something close to it? The make-or-break work is getting buyers to act on a rule that has rarely been enforced, and that's the kind of thing I help founders figure out. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.