Skip to content
Skip to content
FOR NBFCS AND LOAN AGENTS

DPDP-compliant document collection. Built for how an NBFC and its agents work.

Your borrowers’ PAN, Aadhaar, bank statements and income proofs are personal data under the DPDP Act, on top of what the RBI already asks. Confidential Dispatch lets you collect them the way the Act requires, so every loan file’s KYC arrives compliant and sits in one place, application by application.

Start free, no card required LIVE AT APP.CONFIDENTIALDISPATCH.COM · INDIA
02 · YOUR INTAKE TODAY

Multiple places. No single answer.

Meridian Finance Loan application, LAP 2026-0412 Customer identification under the RBI KYC direction, LAP 2026-0412
PAN Card Document Bank statement, 6 months Document ITR FY 2025-26 Document Property papers DocumentYour documents are kept for 5 years, then deleted. This link stays open for 14 days.
‹ FS Farhan Sheikhonline
Send PAN, Aadhaar and six months’ bank statement10:02✓✓
PDFBank statement.pdf24 pages · PDF
18:40
PDFITR FY 2025-26.pdf6 pages · PDF
18:40
↪ Forwarded
JPGPAN card.jpg1 page · JPG
18:43 COPY 2
Rest tomorrow, sir.18:44
Message
Search mail
Compose Inbox12 Starred Sent Drafts
Farhan Sheikh19:02Re: Re: LAP 2026-0412 KYC – attaching PAN…
DSA · R. Verma19:20Fwd: Fwd: Re: LAP 2026-0412 KYC – to credit
S. Iyer19:31Fwd: Re: LAP 2026-0412 KYC – saved to drive
Farhan SheikhMarthe personal loan file
Re: Re: LAP 2026-0412 KYC
RFarhan Sheikhto me
Forwarding borrower KYC. ITR sent on WhatsApp.
JPGPAN card.jpg
JPGAadhaar front.jpg
ReplyForward
+ New My Drive › Clients › 2025 › Farhan Sheikh Shared with 4
Files
PDFAadhaar back.jpg
PDFProperty papers.pdf
PDFBank_statement_final_v2.pdf
COPY 2
PAN card copy.jpg
COPY 3
✕ 6 DPDP CHECKS FAILED
03 · BUILT IN

DPDP-compliant collection.

Everything the Act asks for at collection. None of it by hand.

PAN cardJPG
PAN CardDocument
Bank statement, 6 monthsPDF
Bank statement, 6 monthsDocument
ITR FY 2025-26PDF
ITR FY 2025-26Document
Property papersPDF
Property papersDocument
HOW IT GOES TODAY

It starts with a message.

A loan application starts with a DSA’s message: “send PAN, Aadhaar and six months’ bank statement”. The borrower sends photos on WhatsApp to the agent, the agent forwards them to the branch, the branch emails them to credit, and someone saves a copy to the shared drive under the application number. Nobody told the borrower why each document was needed beyond “for the loan”, how long it would be kept, or that they could ask for it back. Nothing records that they agreed, or through whom.

UNDER THE ACT

Every step is a gap.

Under the Act, each of those is a gap: no notice, no consent that can be demonstrated, no retention date, no record. And the file passed through an agent’s personal phone on the way in. When a borrower asks what you hold on them, or a regulator asks how you collected it, there is no single answer.

AND THE PRESSURE TO KEEP

So you keep everything, everywhere.

The pressure is not only the Act. The RBI’s KYC directions and the PMLA already fix how long you keep these records after the relationship ends, and the same regulator now expects DPDP consent alongside. So you keep everything, on every agent’s phone, indefinitely. That is exactly what the Act no longer allows.

04 · ONE REQUEST, END TO END

One request, from your desk to their phone and back.

Every request goes out with what the Act asks for at collection: the notice, the consent, the declared purpose, the retention date, the proof record and the path for your client to exercise their rights. You do none of it by hand.

How it works, in full
05Afterwards, kept for 5 years

Five years after the relationship ends, as the RBI’s KYC direction and the PMLA require. Then the documents delete on their own, on the date the notice promised, unless you say otherwise. Every step, from the notice to the deletion, stays on a record that cannot be quietly changed. And your client can ask for a copy, a correction or deletion from the link on their receipt, at any time.

05 · BUILT FOR HOW AN NBFC AND ITS AGENTS WORKS

Built for how an NBFC and its agents works.

See every feature
01

Name documents by the application

Every document in a request has a name you can edit. “Bank statement” becomes “Bank statement, 6 months, LAP 2026-0412” as you type it, so what the borrower uploads is already labelled for the file.

02

One folder per borrower, applications stacked

Every request you send a borrower sits in that borrower’s folder, newest on top. A top-up sits above the original loan without you moving anything.

03

Applicant and co-applicant on one request

One request, two people, each with their own link and their own consent. The guarantor’s KYC lands in the guarantor’s folder, and the request page shows who has sent what and who is still to send.

04

The borrower uploads in a minute, no login

They open the link on their phone, read the notice, agree, and upload, or fetch from DigiLocker where the document is available there. No account, no app, no password to reset. If they sent the wrong page they replace it while the link is open.

05

All borrower documents in one place

Not across an agent’s WhatsApp, the branch’s email, a laptop and a shared drive. One copy, in the borrower’s folder, with who viewed or downloaded it and when. Credit opens it there.

06

Keep sending the way your agents do

The agent copies the link into the WhatsApp chat they already have with the borrower, or opens it pre-written in WhatsApp with one tap, or the system emails it. The chat stays the chat; the KYC stops travelling through the agent’s phone.

07

Your NBFC’s name and your logo, every time

Your NBFC’s name is on every message the borrower gets, and your name and logo are on the page they upload to, so they know the request is from the lender and not a fake-loan scam.

08

Accounts for branch staff and agents, admin for compliance

Invite your team; the work belongs to the NBFC, not to whoever did it. Admins control invites, settings and deletion; branch staff and agents do the work. Every action carries the name of the person who took it.

09

Reminders that chase before sanction

Reminders run on their own until every document is in: by email to the borrower when we sent the link, a nudge to you when you sent it yourself. Month-end disbursals without the follow-up calls.

10

Your borrower list, yours to take

Every borrower your NBFC holds consent for, in one file, any time you want it. And when a borrower asks, everything held on them exports as one file, and can be erased with the proof of erasure kept.

11

A record for when the regulator asks

Every notice shown, consent given, document received, viewed, downloaded, kept or deleted, on a record that cannot be quietly changed. When a borrower, an RBI inspection or the Board asks, you show the record for that request, and through which channel the consent came.

12

Kept for as long as the PMLA says, then gone

Set the retention when you build the request: for the length of the loan, then a second stage for the years the PMLA and the RBI’s KYC directions make you keep the records after the relationship ends. The documents stay through both stages, delete on their own when the second ends, and a borrower’s withdrawal is recorded even while the statutory hold runs.

06 · YOUR TEMPLATE, READY ON DAY ONE

Your template, ready on day one.

Your account starts with a request already built for an NBFC and its agents: Customer KYC, with PAN, an ID proof, a recent photograph and the customer’s full legal name, the purpose and notice written, and the documents kept for as long as they’re your customer, then five years as the RBI’s KYC direction and the PMLA require. Edit what differs and send.

And when a product needs something different, a new template takes about a minute: name it, list the documents, set the retention. Save it once, use it for every borrower, every application. A co-applicant’s KYC, a loan against property, a re-KYC: each one is a template you make once.

READY ON DAY ONECustomer KYC
MADE BY YOUR FIRMCo-applicant KYC
MADE BY YOUR FIRMRe-KYC
Document requests

New request

All requests
Start from a template One secure link per client
Press 1–3 to switch
Collect documents People upload what you ask for. Consent, notice and the files live here. Record consent only You hold the documents yourself. This records the notice and the consent.
Start from 1Blank 2Customer KYC 3Co-applicant KYC 4Re-KYC
01

Who it goes to

Name plus email or phone
Full nameFarhan Sheikh Email[email protected] Phone52301 48762
Saved as +91 52301 48762
Add a person Each person gets their own link. ↵ on a complete row adds the next.
02 Customer KYCfor Customer identification under the RBI KYC direction Change⏎ 03 4 items3 uploads · 1 written answer · all required Change⏎ 04 Kept as long as they're a client, then 5 years by lawlink open 14 days · then deleted Change⏎

What the client sees

Live
Meridian Finance Customer KYC New client onboarding
PAN Card Document ID proof (Aadhaar or passport) Document Recent photograph Document Full legal name AnswerYour documents are kept for as long as they're a client, then 5 years by law, then deleted. This link stays open for 14 days.
Ready to send 1 person gets their own link; the notice is frozen the moment you create. Press ⌘ ↵ to create
SCREEN · BUILDER ON “CUSTOMER KYC” WITH THE CLIENT’S LIVE PREVIEW
07 · YOUR CLIENTS’ DOCUMENTS, KEPT SAFE

Compliance is what you are buying. Security is what makes it credible.

AWS · SOC 2 · ISO 2700119.08°N 72.88°EAP-SOUTH-1 · MUMBAIDOCUMENTS · DATABASE · KEYS · BACKUPS
THE RECORD · SHA-256
18:40CONSENT GIVEN · FARHAN S.a91f
18:41DOCUMENT RECEIVED3c07
11:02VIEWED · YOUR STAFFe5d2
11:05DOWNLOADED · YOUR STAFF7b40
CHAIN INTACT
AES-256-GCMENCRYPTED AT REST · HTTPS IN TRANSIT
DOCUMENT KEY
FIRM KEY
HELD BY YOUR FIRM ONLY
PDFDOCUMENT.PDFFARHAN SHEIKH
HELD BYYOU
SHARED WITHNONE
THIRD PARTIES0
THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

HOSTED ON AWS IN MUMBAI; AWS’S INFRASTRUCTURE IS SOC 2 AND ISO 27001 CERTIFIED.

Collect the DPDP-compliant way from your next application.

Sign up and send your first request in a few minutes. Nothing to install, for you or your clients.Start free, no card required
Read our guide: DPDP for fintech and NBFC KYC, explained