A locked-down work browser for BPO agents who work from their own laptops
TL;DR Tintpane is a work browser that small and mid-size Indian BPOs install on agents' personal laptops. Client apps open only inside it, and copying, downloading, printing and screenshots are blocked or logged. The BPO pays per agent per month. It lets firms hire home-based agents without shipping company laptops.
Since the DoT relaxed its rules for other service providers in November 2020, BPOs can let agents work from home or anywhere without registering, and data-only BPO work fell outside those rules altogether[1]. Many smaller firms took the chance to hire home agents in smaller towns.
What they didn't get is control. An agent on a personal laptop can copy a customer list, photograph a screen or save a file to a home folder. The client, often a bank, insurer or online retailer, still holds the BPO responsible. Under the DPDP Act the client faces penalties of up to ₹250 Cr for weak safeguards[2], and it passes that risk to vendors in contracts. And a full virtual desktop for every agent is costly and slow on home broadband, which anyone who has worked on a patchy connection in a small town will tell you.
What it does, in regulatory terms: security software sold to businesses. No sector licence is needed, and the product helps BPOs meet DPDP and contract duties.
Tintpane is a hardened browser built on an open-source browser engine. The BPO's admin decides which web apps agents may open and what they can do inside them. Data stays in the browser - no copy to outside apps, no download to the laptop, watermarks on screen with the agent's ID, and masking of fields such as card or account numbers. Every session is logged for the client's audit. When the shift ends, nothing stays on the machine.
The seed proposed browser isolation in general. Global vendors already sell that to large enterprises. I think the narrower wedge is price and fit, meaning a tool a 200-seat BPO in a tier-2 city can afford and set up in a day, with logs in India.
Agents use it, but the BPO's owner or IT head pays. Buyers are domestic and export BPOs and KPOs with 50–2,000 seats, and the clients that audit them sometimes pay or insist on a named tool. No public India price exists for an enterprise browser seat, and global vendors sell on quote. The alternative is a company laptop or a virtual desktop seat, both well above a per-agent software fee.
Work from anywhere has been allowed for OSPs since November 2020[1]. CERT-In has required 180-day logs and six-hour incident reports since 2022[3]. The DPDP Act now gives large clients a reason to audit every vendor that touches their customers' data[2].
No public figure exists for Indian BPO spending on browser security. The best signal is from the supply side - one global enterprise-browser company lists BPOs and third-party contractors as target customers[4], and another vendor sells cloud browser isolation[5]. That shows the use case is real. It does not size the India market for small BPOs.
Global enterprise-browser firms sell a browser with data-leak controls and support for personal devices, aimed at large firms[4]. Browser-isolation vendors run risky browsing in its cloud instead of on the laptop[5]. Virtual desktop services do a similar job at a higher cost per seat. The gap is a lower-cost product with Indian hosting, sold and supported for small BPOs.
| Difficulty | Moderate (35/100) |
| Starting capital | ₹70 L–1.2 Cr |
| Time to launch | 9–12 months |
Building on an open-source browser engine is doable but never finished, because every upstream security update must be merged fast. The other hard part is holding up against agents who look for ways around the controls, and proving to a bank's auditor that the browser actually stops leaks.
No product licence is needed for browser software. The rules that matter sit with your BPO buyers.
Client contracts set the real security bar, so read a few early.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI fire or discipline an agent from an alert alone. Odd activity has innocent reasons too, and a supervisor should look first.
Want to work out the AI layer for Tintpane? Talk to Yash →
This is worth trying for a founder with browser or endpoint-security engineering experience and access to BPO owners. If your team doesn't have strong engineers then skip it, because a weak secure browser is worse than none at all. First prove that one client auditor accepts it in place of a company laptop.
Plan for roughly ₹70 L–1.2 Cr, mostly for a strong engineering team to harden and maintain the browser build.
No product licence. Your buyers follow the DoT OSP guidelines, CERT-In directions and the DPDP Act, so your logs and controls should support them.
Yes. Remote support teams exist everywhere. Check local data protection rules and what outsourcing clients in that market expect.
The free Tintpane validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection and OSP checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for BPO owners and client auditors, and 5 assumptions to test. Download the kit →
Thinking about building Tintpane or something close to it? The make-or-break work is getting a bank or insurer's security team to approve it for their vendors, and I'm happy to help you plan that conversation. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.