Boot-integrity proof for staff laptops at brokers, AMCs and mid-size NBFCs
TL;DR Rootvouch is a managed service that reads the trust chip already inside company laptops, blocks access to trading and lending systems from any machine that booted in a tampered state, and files the evidence regulators ask for. Mid-size stockbrokers, AMCs and NBFCs pay per device each month.
Indian financial firms now answer to three overlapping rulebooks. SEBI's cybersecurity and cyber resilience framework for regulated entities came out in August 2024[1]. RBI's IT governance directions, in force since April 2024, ask banks and larger NBFCs to secure remote access and keep a way of identifying every remote device connected to their systems[2]. And CERT-In wants incidents reported within 6 hours and logs kept for 180 days inside India[3].
Staff laptops sit right in the middle of all three. They travel home, get lent to family and pick up unsigned drivers. Most mid-size firms can show that antivirus is installed, but can they show a given laptop booted cleanly this morning? Very few can.
The seed asked for a platform built on a hardware root of trust. That chip already exists, since the current mainstream desktop operating system won't install without TPM 2.0 and Secure Boot-capable firmware[4]. Designing a new one is a semiconductor project and not a startup, so I reframed the idea around the chip that's already there.
Standard device-management tools can already check disk encryption, Secure Boot and code integrity through device health attestation[5]. The gap is that someone has to switch these checks on, tie them to access, chase the exceptions and turn the result into an auditor's file. Rootvouch does that work as a service.
Each laptop's measured boot state feeds an access rule, so a machine that fails gets cut off from the trading terminal or loan system until IT fixes it. The client gets a monthly evidence pack mapped to the SEBI and RBI clauses it is examined on. Other operating systems come later.
The user is the IT or security head at a broker, AMC or Middle-layer NBFC with 100–1,500 laptops. The payer is the same person, often with the compliance officer signing off. There's no published Indian price for this kind of service, so my assumption is ₹300–700 per device a month, sold alongside the endpoint tools they already license.
The SEBI framework is dated 20 August 2024[1], and the RBI directions took effect on 1 April 2024[2]. Older machines without TPM 2.0 are being replaced as firms upgrade their operating system[4], so most fleets will soon carry a usable trust chip. DPDP penalties reach ₹250 crore for weak security safeguards[6], which tends to get a board's attention.
There is no public figure for what Indian firms spend on device attestation or boot integrity. The narrower signal is regulatory scope - the RBI directions apply to all commercial banks, Top, Upper and Middle-layer NBFCs, credit bureaus and all-India financial institutions[2], and the SEBI framework covers its regulated entities[1]. Count those entities in your target city before raising money.
The big device-management and endpoint suites supply the checks but not the people to run them[5]. One US vendor sells firmware and hardware integrity monitoring for enterprise devices, aimed mostly at large US and global firms[7]. Indian managed security providers run SOCs and endpoint tools, but I found none selling boot-state attestation as a packaged compliance service.
That gap is the opening, and to be honest it may be a small one.
| Difficulty | Moderate (44/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 6–9 months |
The software is mostly integration. The hard parts are trust and patience. A security vendor needs its own ISO-style certification before a broker lets it anywhere near trading systems, and if you lock out a trader at 9:14 a.m. because a laptop failed a check then you'll lose the account unless the grace rules are right.
Rootvouch needs no licence to operate. The rules that matter are the ones your clients are examined on.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide to restore access to a failed machine or sign off an audit statement. Those calls carry regulatory weight and need a person.
Want to work out the AI layer for Rootvouch? Talk to Yash →
Here's what can go south -
I'd look at this if you've run security at a broker or NBFC and can get a CISO meeting with a phone call. If you're hoping to build chips or sell to consumers then it's a weak fit. Prove one thing first - that three firms will pay for the evidence pack before you build anything beyond scripts.
Plan for roughly ₹1.2–2.2 Cr, mostly on a small engineering team, compliance mapping and a long sales cycle with regulated firms.
No licence for you. Your clients are examined against SEBI and RBI rules, so your reports must map to them, and you must follow CERT-In directions and the DPDP Act.
Yes, since TPM and Secure Boot are standard on current business laptops everywhere. Map your reports to the local financial regulator's cyber rules instead.
The free Rootvouch validation kit has the line-by-line capital breakdown, the effort scoring, the regulatory checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for security heads and compliance officers, and 5 assumptions to test. Download the kit →
Thinking about building Rootvouch or something close to it? The make-or-break work is getting a regulated firm to let an outsider gate access to its trading or lending systems. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.