Attested clean rooms where lenders and insurers pool data without sharing it
TL;DR Quorumcell rents secure enclaves from the big clouds and packages them as clean rooms. A bank, an NBFC and an insurer can then run an agreed analysis on their combined customer data while none of them, nor the cloud, sees the others' raw records. Financial firms pay per project plus a platform fee.
Indian lenders and insurers want to learn from each other's data - overlap in customers, fraud rings that span institutions, co-lending risk. Sending raw files to a partner is exactly what the DPDP Act makes risky. Every data fiduciary must take reasonable security safeguards to prevent breaches[1], and failing to do so carries the highest penalty in the law, up to ₹250 crore[2].
Consent-based sharing already runs at scale. The Account Aggregator network counts over 2,880 million enabled accounts and 1,076 financial information users[3]. That system moves one customer's data with consent. It does not let two institutions compute on pooled data while keeping it private from each other.
What it does, in regulatory terms: a technology provider acting as data processor for its clients. It is not an Account Aggregator, credit bureau or lender, and holds no RBI licence. Each client remains the data fiduciary for its own records.
The seed asked for remotely attestable, hardware-isolated computing. Building that hardware is a chipmaker's job, and the clouds already rent it. One big cloud's confidential service runs on chipmakers' secure-enclave machines and releases data only to workloads that pass attestation[4]. So I reframed the idea as the layer on top.
Here's how it works - Quorumcell gives each party a key it controls, and the parties agree on one piece of code, say a fraud-overlap count or a joint model. The enclave proves to every party's key service that it is running exactly that code, and only then are the keys released. Outputs are aggregated and checked for leaks before anyone sees them. India's DEPA training design describes the same pattern, with attestation gating key release[5].
The users are risk, fraud and analytics teams. The payer is the head of risk or data at a bank, NBFC or insurer, often with the CISO's sign-off. There's no public price for clean-room projects in India. My assumption is ₹15–40 lakh per project for the first deals, moving to annual platform fees once trust builds.
The DPDP Rules were notified in November 2025[2], which raises the cost of careless sharing. RBI's IT governance directions, in force since April 2024, tighten oversight of outsourced technology at banks and larger NBFCs[6]. And rentable confidential VMs and GPUs now exist on the major clouds[4][7].
There is no public figure for confidential computing or data clean-room spending in India. The closest signal is the Account Aggregator network, with 1,076 financial information users and over 295 million data shares a month as of June 2026[3]. Those firms already pay to receive data. How many also want to compute jointly? Nobody knows yet, so treat it as adjacent and not your market.
The big cloud providers sell the underlying confidential compute[4][7]. One US vendor sells confidential AI with hardware attestation and key release, aimed at global enterprises[8]. The iSPIRT-linked DEPA effort publishes an open design for confidential clean rooms, but it isn't a commercial service[5].
I found no Indian company packaging this for lender and insurer use cases.
| Difficulty | Hard (56/100) |
| Starting capital | ₹2–3.8 Cr |
| Time to launch | 12–18 months |
The cryptography is rented, so the hardest parts are elsewhere. Banks' legal and security teams will spend months on each contract. Proving that outputs can't leak individual records takes careful privacy engineering. And getting three institutions to agree on one analysis is slower than building it, by a long way.
Quorumcell needs no RBI licence, as long as it stays a technology provider and never scores individuals for lending itself.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
AI here must never make a lending or claims decision about a person. Results go back to each client as aggregates, and they decide.
Want to work out the AI layer for Quorumcell? Talk to Yash →
Here's what can go south -
I'd back a founder with security engineering depth and existing relationships in bank risk teams. If you're expecting quick SaaS revenue then walk away now. Before raising money, get one bank and one insurer to sign a paid pilot on a single fraud question.
Plan for roughly ₹2–3.8 Cr, mostly on a strong engineering team, cloud costs and long pilots with banks and insurers.
Not if you stay a technology provider and processor. Clients remain responsible for their data, and you meet DPDP safeguards and their RBI vendor reviews. Confirm your structure with a lawyer.
Yes, since the confidential computing machines are rented from global clouds. Check local data protection law and what your financial regulator says about sharing customer data.
The free Quorumcell validation kit has the line-by-line capital breakdown, the effort scoring, the regulatory and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for risk heads and CISOs, and 5 assumptions to test. Download the kit →
Thinking about building Quorumcell or something close to it? The make-or-break work is getting two regulated firms to agree on one joint question and sign the same contract. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.