Where is our personal data?
Across databases, exports, spreadsheets and vendor systems. Not where you think it is — where it actually is.
Know where personal data lives. Prove it is gone.
A data discovery, classification and erasure engine that runs inside your network — and closes every deletion request with a certificate naming what was erased, what was kept, and under which statute.
LekhabyANOCLOUDIn build · first installs being chosen
Lekha is in build. It runs end to end — every screen in the walkthrough is captured from a live deployment — but on a synthetic estate: no client system has been connected to it yet, and no external auditor has reviewed an evidence pack. We are choosing the first installs now, and would rather tell you that here than in the third meeting.
The problem
Three questions you will be asked.
Regulator · bank due-diligence · your own auditor
What may we keep, and until when?
Some data must be deleted on request. Other data must be kept for years because another law says so. Both are true at once.
Can we prove what we did?
Not a promise in a policy document. Evidence a third party will accept, produced by the system itself.
What you are left holding
Know. Decide. Prove.
A data map that maintains itself
Generated by your systems on a schedule, with the evidence behind every finding — and no raw personal data stored.
Aadhaar, PAN and GSTIN confirmed by checksum, not by a guess at the column name.
Retention rules you can read
Each clause naming its statute, its period and what happens at the end. Your counsel can review every line.
For example the Prevention of Money-Laundering Rules, 2005 — not just “five years”.
Evidence produced as you work
Certificates, a chained record of every action, and one archive an examiner reads. Not a report written afterwards.
Each export is logged: your name, the moment, and the exact scope of what left the appliance.
The machine
Nine stations, one boundary.
Everything below is a zoom into one of them
Your network · nothing leaves it
- 01SourcesDatabases, object stores, exports, vendor systems.
- 02ScanRead-only. Finding data cannot change data.
- 03RegisterThe map, with the evidence behind every finding.
- 04RulesRetention clauses, each naming its statute.
- 05PrecedenceWhich law wins when two are true at once.
- 06RequestA deletion arrives, and the clock starts.
- 07CustodySeven steps, two people, one of them not you.
- 08RecordAppend-only, hash-linked, and it says so.
- 09CertificateWhat went, what stayed, and under which law.
Four of these nine open into a diagram further down. The locator beside each one says which station you are looking at.
Station 07 · Custody
Seven steps. Two different people.
Nothing is destroyed until somebody has seen what would be
- 01RaiseLog the request and the date it arrived. The clock starts from that date, not today.
- 02AttestRecord how you proved this is really them. Without it, nothing can be searched.
- 03SimulateA dry run. Exactly what would go, and exactly what would stay, under which clause.
- 04ApproveA second person signs against the dry run. Never the person who raised it.
- 05EraseRuns on a credential issued for this job only, and handed back when it ends.
- 06VerifyReads the systems again. Deleted but never re-checked counts as a failure.
- 07CertifyCloses in one of three states only, taken from what actually happened.
The handover Steps one to three and steps four to seven cannot be the same person. The rule sits in the engine, not in a policy document.
Station 05 · Precedence
Two laws are true at once.
And the certificate says which
One of them wins, and the certificate says which.
- 1Legal holdA live investigation. Outranks everything below it.
- 2Statutory retentionA five-year KYC obligation the law imposes on you.
- 3Erasure triggerThe request itself — purpose served, or consent withdrawn.
A request closes in one of three states. There is no fourth.
Fully erasedErased with named retentionsFailed
The boundary · every station sits inside it
It runs inside your network.
Your networkNothing is sent anywhere.
DatabasesObject storesExportsVendor systems
Lekhareads · classifies · records- No telemetry. Nothing reports back to us.
- No phone-home. No licence check, no update fetch.
- No runtime downloads. Offline install onto one machine.
- One way out. An export you ask for — and every export is logged.
- Read-only. Scanning uses credentials that cannot write, proven against your own systems.
Station 08 · Record
Every action, permanently.
Alter an entry and watch what happens
- 01Signed inr.menon↳ links to 00
- 02Viewed registerr.menon↳ links to 01
- 03Simulated erasurer.menon↳ links to 02
- 04Approveda.iyer↳ links to 03
- 05Eraseda.iyer↳ links to 04
- 06Exported evidencea.iyer↳ links to 05
Each entry carries the previous entry’s fingerprint. Alter any one of them and see what happens.
Before the ask — what it is not
- Not a consent management platform
- Requests are received however you receive them today. Lekha is the engine that fulfils them and produces the proof.
- Not a data catalogue rival
- The register is deliberately thin. Where you already run a catalogue, Lekha publishes into it rather than competing with it.
- Not a public rights portal
- No front-office. It sits behind whatever intake you already use.
- Not an endpoint agent
- No traffic inspection, no agents on laptops. Lekha works on data at rest, in the systems your business actually runs on.
The next step
A scan of one of your own systems.
2 daysto install, inside your network
0write credentials — discovery is read-only, proven against your own systems
4 hoursto the first register, from the first system being connected
The DPDPA readiness assessment stands on its own, and produces the data map a deployment would start from.