VAPT Services in Bengaluru

Yes. Most Bengaluru SaaS scale-ups need a SOC 2 Type II window pentest report within their auditor's observation period. Our 7-day fast-track engagement covers OWASP Top 10, business logic, multi-tenancy isolation, OAuth / SSO and produces auditor-ready evidence mapped to TSC CC7.1 and CC8.1.

Yes. We red-team LLM-backed products against the OWASP LLM Top 10 — prompt injection, training-data poisoning, sensitive information disclosure, model DoS, supply-chain risk in model weights and embeddings, agent / tool-use abuse, and excessive agency in autonomous agents. Output is a developer-facing report with PoC payloads, not just a CVSS list.

No. AxVeil is not currently on the CERT-In Information Security Auditor empanelment list. For audits where the regulator legally requires an empanelled signature — RBI digital lending guideline audits, RBI account aggregator audits, NPCI UPI scheme certifications, the formal RBI cyber-security framework submission — AxVeil delivers the technical engagement under sub-contract to an empanelled partner firm who signs the regulator-facing report. For SaaS, SOC 2 readiness, DPDP advisory, OWASP-aligned application VAPT and ongoing offensive security, AxVeil contracts directly. The contracting path is stated in the proposal up front.

Yes — at the technical and advisory level. We assess lending apps and LSP (Loan Service Provider) integrations against the RBI digital lending guidelines including the FLDG cap framework, KFS disclosures, escrow flows, customer-data segregation between LSP and RE, and the cooling-off period implementation. Pre-regulator readiness, ongoing offensive security and evidence-pack design AxVeil contracts directly. The formal regulator-facing audit submission is delivered via a CERT-In empanelled partner firm. Reference: https://www.rbi.org.in.

NPCI scheme certification security audits and the formal PA / PG authorisation-track audit submission require a CERT-In empanelled audit firm on the signed report — AxVeil delivers the technical work under sub-contract to an empanelled partner who signs the regulator submission. Pre-certification readiness, ongoing offensive security against the UPI / IMPS / NACH integration surface, and merchant-side PSP integration testing (Razorpay / Cashfree / PayU) AxVeil contracts directly. Reference: https://www.npci.org.in.

If you process personal data of individuals in India — including employees, customer end-users or buyer-side contacts — you are a data fiduciary under the DPDP Act 2023. Obligations include consent architecture, purpose limitation, data principal rights workflow, breach notification to the Data Protection Board, and possible Significant Data Fiduciary designation. Penalties go up to INR 250 crore per instance. Reference: https://www.meity.gov.in.

Remote-first by default — testing, daily standups and the readout call run over Slack / Teams / Zoom in IST hours. Engagements are served across Whitefield, ORR, Electronic City, Koramangala, Indiranagar, HSR and Manyata. Onsite kick-offs for sensitive internal AD or SOC 2 walkthroughs are arranged on a per-engagement basis.

Yes. We sign MSAs and DPAs under Indian law with jurisdiction in Bengaluru courts, raise GST-compliant INR invoices, and accept payments in INR or USD via wire or Stripe. We also support TDS deduction at 2% / 10% as applicable.