Skip to content
Skip to content
FOR FINTECHS

DPDP-compliant document collection. Built for how a fintech ops team works.

The KYC your ops team collects by hand, for merchant onboarding, business accounts and re-KYC, is personal data under the DPDP Act, and your partner bank’s DPDP clause expects you to show it. Confidential Dispatch lets you collect it the way the Act requires, without a compliance team.

Start free, no card required LIVE AT APP.CONFIDENTIALDISPATCH.COM · INDIA
02 · YOUR INTAKE TODAY

Multiple places. No single answer.

Kite Payments Merchant onboarding, MID 88213 Merchant onboarding and partner bank KYC, Bloom Organics, MID 88213
Director PAN, N. Kapoor Document GST certificate Document Certificate of incorporation Document Cancelled cheque DocumentYour documents are kept for 5 years, then deleted. This link stays open for 14 days.
‹ NK Neha Kapooronline
Please share GST, incorporation certificate and the directors’ KYC10:02✓✓
PDFGST cert.pdf1 page · PDF
18:40
PDFIncorporation.pdf2 pages · PDF
18:40
↪ Forwarded
JPGDirector PAN.jpg1 page · JPG
18:43 COPY 2
Rest in the form.18:44
Message
Search mail
Compose Inbox12 Starred Sent Drafts
Neha Kapoor19:02Re: Re: MID 88213 onboarding – attaching PAN…
Ops desk19:20Fwd: Fwd: Re: MID 88213 onboarding – for risk
S. Iyer19:31Fwd: Re: MID 88213 onboarding – saved to drive
Neha KapoorMarlast year’s re-KYC
Re: Re: MID 88213 onboarding
RNeha Kapoorto me
Attaching the director’s PAN and Aadhaar. GST and incorporation sent on WhatsApp.
JPGDirector PAN.jpg
JPGDirector Aadhaar.jpg
ReplyForward
+ New My Drive › Clients › 2025 › Neha Kapoor Shared with 4
Files
PDFBoard resolution.pdf
JPGCheque.jpg
PDFGST_cert_final_v2.pdf
COPY 2
PAN card copy.jpg
COPY 3
✕ 6 DPDP CHECKS FAILED
03 · BUILT IN

DPDP-compliant collection.

Everything the Act asks for at collection. None of it by hand.

Director PANJPG
Director PAN, N. KapoorDocument
GST certificatePDF
GST certificateDocument
IncorporationPDF
Certificate of incorporationDocument
Cancelled chequeJPG
Cancelled chequeDocument
HOW IT GOES TODAY

It starts with a message.

A merchant onboarding starts with a message from ops: “please share GST, incorporation certificate and the directors’ KYC”. The documents arrive in a WhatsApp group, a Google form, and an email thread with the partner bank in copy. Someone downloads them to a laptop, uploads them to a shared drive, and pastes a link into the CRM. Nobody told the merchant’s director why their personal Aadhaar was needed for a company account, how long it would be kept, or that they could ask for it back. Nothing records that they agreed.

UNDER THE ACT

Every step is a gap.

Under the Act, each of those is a gap: no notice, no consent that can be demonstrated, no retention date, no record. When the partner bank’s audit asks how a director’s KYC was collected, or the director asks what you hold, there is no single answer.

AND THE PRESSURE TO KEEP

So you keep everything, everywhere.

The pressure is not only the Act. Your partner bank and the RBI’s KYC directions already fix what you collect and how long you keep it, and the bank’s agreement now pushes DPDP obligations down to you. So ops keeps everything, in every tool, indefinitely. That is exactly what the Act no longer allows.

04 · ONE REQUEST, END TO END

One request, from your desk to their phone and back.

Every request goes out with what the Act asks for at collection: the notice, the consent, the declared purpose, the retention date, the proof record and the path for your client to exercise their rights. You do none of it by hand.

How it works, in full
05Afterwards, kept for 5 years

Or any period you choose. Then the documents delete on their own, on the date the notice promised, unless you say otherwise. Every step, from the notice to the deletion, stays on a record that cannot be quietly changed. And your client can ask for a copy, a correction or deletion from the link on their receipt, at any time.

05 · BUILT FOR HOW A FINTECH OPS TEAM WORKS

Built for how a fintech ops team works.

See every feature
01

Name documents by the account

Every document in a request has a name you can edit. “GST certificate” becomes “GST certificate, Bloom Organics, MID 88213” as you type it, so what the merchant uploads is already labelled for the account.

02

One folder per merchant, onboardings and re-KYC stacked

Every request you send a merchant sits in that merchant’s folder, newest on top. This year’s re-KYC sits above the original onboarding without you moving anything.

03

The merchant uploads in a minute, no login

They open the link on their phone, read the notice, agree, and upload, or fetch from DigiLocker where the document is available there. No account on your side, no app, no password to reset. If they sent the wrong file they replace it while the link is open.

04

All merchant documents in one place

Not across a WhatsApp group, a form, a drive and a CRM link. One copy, in the merchant’s folder, with who viewed or downloaded it and when. Risk opens it there.

05

Keep sending the way ops does

Copy the link into the WhatsApp chat ops already has with the merchant, or open it pre-written in WhatsApp with one tap, or let the system email it. The chat stays the chat; the KYC stops travelling through it.

06

Your company’s name and your logo, every time

Your company’s name is on every message the merchant gets, and your name and logo are on the page they upload to, so they know the request is from you and not a phishing attempt.

07

Accounts for ops and risk, admin for the founders

Invite your team; the work belongs to the company, not to whoever did it. Admins control invites, settings and deletion; ops and risk do the work. Every action carries the name of the person who took it.

08

Reminders that chase before go-live

Reminders run on their own until every document is in: by email to the merchant when we sent the link, a nudge to you when you sent it yourself. Onboarding targets without the follow-up calls.

09

No backups to run

Documents, database, keys and backups are held in India (Mumbai), encrypted, and backed up for you. Nothing to configure, nothing to copy.

10

Your merchant list, yours to take

Everyone your company holds consent for, in one file, any time you want it, and the whole account as a complete, self-verifying export when a partner bank’s due diligence asks for it. When a merchant leaves, everything held on them exports as one file, and can be erased with the proof of erasure kept.

11

A record for when the partner bank asks

Every notice shown, consent given, document received, viewed, downloaded, kept or deleted, on a record that cannot be quietly changed. When the bank’s audit, a customer or the Board asks, you show the record for that request.

12

Kept for as long as the PMLA says, then gone

Set the retention when you build the request: for the length of the relationship, then a second stage for the years the PMLA and the RBI’s KYC directions make you keep the records after it ends. The documents stay through both stages, delete on their own when the second ends, and a withdrawal is recorded even while the statutory hold runs.

06 · YOUR TEMPLATE, READY ON DAY ONE

Your template, ready on day one.

Your account starts with a request already built for a fintech ops team: Customer onboarding documents, with PAN, an ID proof, a recent photograph and the customer’s full legal name, the purpose and notice written, and the documents kept for as long as they’re your customer. Edit what differs and send.

And when a flow needs something different, a new template takes about a minute: name it, list the documents, set the retention. Save it once, use it for every merchant, every year. A re-KYC, a partner bank exception, a sole-proprietor account: each one is a template you make once.

READY ON DAY ONECustomer onboarding documents
MADE BY YOUR FIRMRe-KYC
MADE BY YOUR FIRMPartner bank exception
Document requests

New request

All requests
Start from a template One secure link per client
Press 1–3 to switch
Collect documents People upload what you ask for. Consent, notice and the files live here. Record consent only You hold the documents yourself. This records the notice and the consent.
Start from 1Blank 2Customer onboarding documents 3Re-KYC 4Partner bank exception
01

Who it goes to

Name plus email or phone
Full nameNeha Kapoor Email[email protected] Phone52301 48762
Saved as +91 52301 48762
Add a person Each person gets their own link. ↵ on a complete row adds the next.
02 Customer onboarding documentsfor Customer onboarding Change⏎ 03 4 items3 uploads · 1 written answer · all required Change⏎ 04 Kept as long as they're a clientlink open 14 days · then deleted Change⏎

What the client sees

Live
Kite Payments Customer onboarding documents New client onboarding
PAN Card Document ID proof (Aadhaar or passport) Document Recent photograph Document Full legal name AnswerYour documents are kept for as long as they're a client, then deleted. This link stays open for 14 days.
Ready to send 1 person gets their own link; the notice is frozen the moment you create. Press ⌘ ↵ to create
SCREEN · BUILDER ON “CUSTOMER ONBOARDING DOCUMENTS” WITH THE CLIENT’S LIVE PREVIEW
07 · YOUR CLIENTS’ DOCUMENTS, KEPT SAFE

Compliance is what you are buying. Security is what makes it credible.

AWS · SOC 2 · ISO 2700119.08°N 72.88°EAP-SOUTH-1 · MUMBAIDOCUMENTS · DATABASE · KEYS · BACKUPS
THE RECORD · SHA-256
18:40CONSENT GIVEN · NEHA K.a91f
18:41DOCUMENT RECEIVED3c07
11:02VIEWED · YOUR STAFFe5d2
11:05DOWNLOADED · YOUR STAFF7b40
CHAIN INTACT
AES-256-GCMENCRYPTED AT REST · HTTPS IN TRANSIT
DOCUMENT KEY
FIRM KEY
HELD BY YOUR FIRM ONLY
PDFDOCUMENT.PDFNEHA KAPOOR
HELD BYYOU
SHARED WITHNONE
THIRD PARTIES0
THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

HOSTED ON AWS IN MUMBAI; AWS’S INFRASTRUCTURE IS SOC 2 AND ISO 27001 CERTIFIED.

Collect the DPDP-compliant way from your next onboarding.

Sign up and send your first request in a few minutes. Nothing to install, for you or your clients.Start free, no card required
Read our guide: DPDP for fintech, explained