DPDPA-aligned, not DPDPA-stamped
India MSSPs are being asked for "DPDPA ready" managed services. Some will be tempted to borrow a European GRC logo and a US privacy platform and hope. ScopeMantle's India partner program is narrower: OAuth-sourced processor inventory, DSAR operations with counsel in the loop, and a consulting checklist. We will not hand you a certification we do not hold. If that makes the one-pager shorter, good.
Open program terms are the same as global: 70 / 30, deal registration, no direct-sale conflict, co-brand, no min commit. Partners. Operator checklist the client can read: DPDPA checklist.
1. Processor discovery
Export formatted for significant-fiduciary conversations: client ID, scopes, owner, inferred categories, vendor HQ if we have it. HQ is a triage column. Legal decides transfer mechanism per row. We do not run that analysis. Do not sell it as if we do.
2. DSAR operations
White-label intake if the MSP wants it (skin rules). Templates adapted for India clocks by client counsel, not by a global default of 30 days. Parallel playbook workflows. Erasure includes revoke.
3. Enablement kit
Training deck, assessment SOW template (employee-band cap, wholesale overage), QBR metrics (grant count, below-forty, DSAR median, leftover grants on terminated users). Deal registration before the first client workshop so we are not competing with you on the same logo.
4. What we do not claim
- DPDPA certification or audit opinion.
- HIPAA / BAA.
- Entra GA.
- Local hosting as a product fact unless it is on the site as a fact. Do not invent a Mumbai region in a pitch. Inventory export's HQ column is the data we will talk about.
- Customer counts.
Classification comes first
Significant fiduciary work is legal work. The program assumes the client has counsel. If they do not, your first deliverable is not software. It is an introduction to a lawyer. Selling inventory into an unclassified entity is how you inherit their regulatory surprise.
What to do this week
- Read the checklist and the global audit bundle.
- Strip any draft collateral that says "certified" or "HIPAA."
- Register the first deal. Book a demo.
90-day delivery plan you can put in an SOW
Days 1 to 15: classify the client with their counsel. Fiduciary versus significant fiduciary is not your call. Connect Google and Okta read-only. Manual Entra export if they insist, labelled Beta. Deliver a processor inventory CSV with an HQ column and a one-page gap list (RoPA versus grants).
Days 16 to 45: attestation sprint on Tier 1 scopes. Revoke leftovers on terminated contractors, which are common in India IT services. Stand up DSAR intake only after the counsel gate and SPF/DKIM exist. Run one tabletop: vendor discloses, revoke a fictional client ID, draft a notice outline without sending it.
Days 46 to 90: monthly digest, RoPA tickets for net-new grants, QBR with four numbers (grants, below-forty, DSAR median if any cases ran, terminated leftovers). If they want a DPDPA certificate, you refuse and offer the evidence pack. That refusal keeps you off a regulator quote.
Workshop agenda (half day)
- Data path: why a CASB missed Drift-class replay. Fifteen minutes. No keynote.
- Live Admin export on a projector if they allow it. Count rows. That number funds the rest of the day.
- Scope rubric: mail, Drive, directory. They argue. You write it down.
- DSAR clock: India versus GDPR. Counsel in the room or the workshop stops at inventory.
- SOW edges: employee band, wholesale overage, Entra footnote, no certification clause.
Collateral review checklist
- No certified, attested, HIPAA, BAA, or "SOC 2 report included."
- No Entra generally available.
- No hosted-in-India claim unless the public site says so.
- No customer logos borrowed from us. We do not have a wall.
- Templates marked operator-reviewed.
- 70 / 30 and list price $5 / $6 visible so finance does not invent a third tariff.
Cross-border HQ flags will tempt people to write "blocked" in the export. Do not. Unknown HQ is a ticket for legal, not a product auto-block. Consent-manager contradictions (banner says no, grant says yes) are DPIA triggers. Same rule.
Staffing the service
One analyst can run inventory reviews for a handful of mid-size tenants if the digest is weekly and revoke is batched. DSAR volume does not scale that way. Price DSAR as a burst SKU or you will eat the clock. Do not put a junior analyst on subject letters. Put them on inventory diffs and escalation tracking.
Subprocessor notice: you, plus ScopeMantle, plus any ticketing you insert. Write the list once. Clients in India will ask. Answer with the real names, not "standard cloud."
Failure modes unique to this motion
- Selling to an unclassified entity because the logo was at a conference.
- Using GDPR thirty-day language in a DPDPA letter.
- Promising on-prem ScopeMantle. We do not sell that on this site.
- Commingling two client inventories in a demo tenant. Instant trust-killer and a SOC finding for you.
- Letting the client's marketing publish "DPDPA compliant via our MSSP" on the back of an OAuth CSV.
What to tell a prospect in one paragraph
We will list every third-party OAuth grant on your Google and Okta tenants, score the dangerous scopes, and run DSAR outreach from that list. Counsel stays in charge of classification and letters. ScopeMantle is the inventory and workflow, priced at five dollars per employee annual list, wholesale to us. Entra is Beta. Nobody here is selling a government stamp. If they want a stamp, you are in the wrong meeting.
QBR one-pager for an India client
- Classification status (counsel memo date or "not done").
- Grant count, below-forty, terminated leftovers.
- DSAR median and vendor non-response, if any cases ran.
- Consent-versus-grant contradictions still open.
- Entra footnote if applicable.
- Subprocessor list current yes/no.
If classification is "not done" in quarter two, the QBR is about that, not about a new SKU. You are allowed to pause DSAR white-label until counsel exists. You are not allowed to keep charging for a stamp you invented.
How this sits next to the global bundle
The OAuth assessment is the same PDF outline. The India program adds clocks, fiduciary language, and a harder no on certification claims. White-label DSAR is optional and follows the counsel gate. Do not sell all three on day one to a 40-person shop. Sell inventory. Add the rest when the leftover-grant number is real.
Field guide: first workshop in Mumbai or Bengaluru
Bring a live Admin export if they allow it, not a generic slide. Count rows in the room. That number funds the SOW. If they will not export, you do not have a buyer. You have a tourist. Register the deal only when a named counsel path exists. Selling inventory into an unclassified entity is how you inherit a surprise.
Strip the words certified, HIPAA, and hosted-in-India from every leave-behind before you print. If a designer added a seal, delete the seal. Co-brand is allowed. Fantasy compliance marks are not.
Pricing the India SKU
Keep list $5 / $6 visible. Wholesale 70 / 30. Employee-band cap. DSAR as a burst add-on, not unlimited letters for a fixed fee. Classification workshop can be a separate day-rate with a lawyer in the room. If you cannot find a lawyer, you cannot sell the workshop. Software does not replace that seat.
Entra Beta footnote in every SOW that mentions Microsoft. Subprocessor list: you, ScopeMantle, ticketing. Write it once in English the client's counsel will accept. No customer counts. Terms. Demo.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
A note for the India partner lead
Classification first. Live row count in the workshop. No seals. No hosted-in-India fiction. No GDPR letterhead. DSAR as burst, not unlimited letters. Counsel in the room or the workshop stops at inventory. Same wholesale terms as global. Same public list price. Same Beta labels. If quarter two still says classification not done, the QBR is about that, not a new SKU.
What you can do without buying anything
Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.
When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.
Leave-behinds get a second pair of eyes for the words certified, HIPAA, and hosted-in-India. If a designer added a seal, the seal goes. Co-brand is enough. Fantasy marks are how you inherit a regulator quote.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.