Locations · India

AI security and VAPT, anywhere in India.

From Bengaluru we work with companies anywhere in India, from banks and fintechs in Mumbai to product teams in Delhi NCR, Hyderabad, Chennai and Pune. Most testing is remote, and every engagement is built around the Indian rules you answer to.

Get a fixed-price quote See which rules apply
Remote testing across IndiaDPDP, CERT-In, RBI, SEBI, IRDAIOn-site visits by arrangement
In plain words

HanulSec serves companies anywhere in India from its office in Bengaluru. AI red teaming, penetration testing (VAPT), cloud reviews and most incident response work are done remotely under written authorisation, so where you are matters far less than what you need tested. Every engagement maps to the Indian rules you answer to: the DPDP Act, the CERT-In directions and, for regulated firms, RBI, SEBI or IRDAI.

Coverage
All of India
Delivery
Remote, on-site by arrangement
Indian rules
DPDP, CERT-In, RBI, SEBI, IRDAI
Proposal
Within one business day
Which Indian rules apply

Your sector, your rulebook.

Two rules reach almost every company in India. Regulated sectors add their own, and customers often ask for certificates on top.

Which Indian rules apply by sector. Every sector answers to the DPDP Act and the CERT-In directions. Banks, NBFCs and payment firms also answer to the RBI; brokers, funds and AMCs to SEBI; insurers to IRDAI. Customers or partners usually ask for ISO 27001 in every sector, SOC 2 from SaaS, AI product companies and global capability centres, and ISO 42001 from AI product companies. DPDP ACTCERT-INRBISEBIIRDAIISO 27001SOC 2ISO 42001SaaS and startupsAI product companiesBanksNBFCs and payment firmsBrokers, funds and AMCsInsurersHospitals and health techGlobal capability centres The law or your regulator requires it Customers or partners usually ask for it
A simplified view. The DPDP Act’s main duties apply from 13 May 2027; the CERT-In directions apply now. Click a heading to open our guide.
Across India

Different cities, different questions.

  • Mumbai

    Banks, NBFCs, brokers and insurers: RBI, SEBI and IRDAI testing cycles, and AI used in lending, KYC and support.

  • Delhi NCR

    Consumer apps, edtech and government suppliers: CERT-In readiness, DPDP duties and AI chatbots that talk to millions of users.

  • Hyderabad

    Global capability centres, pharma and health: testing to a parent company’s standards and protecting research and patient data.

  • Chennai

    SaaS companies selling to the US and Europe: SOC 2 readiness, pen tests for customer questionnaires, and AI features in products.

  • Pune

    Product engineering and manufacturing: application and cloud testing, and network security across offices and plants.

  • Kolkata, Ahmedabad and beyond

    Wherever you are, the work is the same: remote testing under written authorisation, a clear report and a free retest.

How it works

From first call to free retest.

  1. DAY 0

    Free call

    30 minutes on video to understand what you need tested and which rules apply to you.

  2. DAY 1

    Fixed-price proposal

    Scope, timeline and price in writing within one business day, with a mutual NDA first.

  3. TESTING

    Remote testing

    We test from known addresses you can allow-list, under written authorisation, in the windows you approve.

  4. REPORT

    Report and read-out

    A report your developers and auditors can both use, walked through on video or in person.

  5. RETEST

    Free retest

    Once you have fixed the findings, we test them again at no extra charge.

Questions

India questions, answered.

Q01Do you work outside Bengaluru?
Yes. We serve companies anywhere in India. Most testing is remote, so being in Mumbai, Delhi NCR, Hyderabad, Chennai, Pune or Kolkata makes little difference to how the work runs.
Q02Do you need to visit us for a penetration test?
Usually not. Web, mobile, API, cloud and AI testing are done remotely. For internal networks we set up a small test machine inside your network that connects securely to our team. If you want someone on site, for a workshop or a drill, we can arrange it.
Q03Are you CERT-In empanelled?
No. Government bodies, and banks and market entities regulated by RBI and SEBI, need CERT-In empanelled auditors for their formal security audits. We prepare you for those audits, test your systems, including AI, and help fix findings before the auditor arrives. See our CERT-In guide.
Q04Which rules do Indian companies need to follow?
Almost every company answers to the DPDP Act and the CERT-In directions. Banks and NBFCs add RBI’s rules, brokers and funds SEBI’s, and insurers IRDAI’s. Many also need ISO 27001 or SOC 2 for customers, and ISO 42001 if they build AI.
Q05Can you help with an incident outside Bengaluru?
Yes. Call the 24/7 incident line on +91 0080887899. Most incident response starts remotely, with log access and containment steps, and we can travel when hands-on work is needed.
Q06Do you test AI built by Indian startups?
Yes, it is our main focus: chatbots, copilots, voice agents, RAG systems and AI agents, tested against the OWASP Top 10 for LLM Applications, with findings mapped to the DPDP Act where personal data is involved. See AI security.
Next hops

Related pages

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings