In progress
Work that is under way now.
- GDPR (EU) and UK GDPR
- India DPDP Act 2023 and DPDP Rules 2025
- CERT-In Directions 2022
- India IT Act section 43A and SPDI Rules
- PCI DSS v4.0.1 SAQ-A, with card details staying on Razorpay's hosted page
- CSA STAR Level 1 self-assessment
- OWASP ASVS Level 1 self-assessment
- EU AI Act Article 50, on telling people they are talking to an AI
- European Accessibility Act and WCAG 2.1 AA
- EU Data Act, on exporting shop data and switching
- EU Digital Services Act
- ePrivacy and UK PECR
- US TCPA and CAN-SPAM
- TRAI TCCCPR and DLT
- Meta Platform Terms and WhatsApp Business Policy
- Google Play policies
- Sanctions checks by country, phone and email domain
Planned
Next on the list.
- ISO/IEC 27001:2022, with the work planned for early 2027
- ISO/IEC 27701, as an optional addition to that audit
- Penetration test by a CERT-In empanelled auditor
Later
If customers ask for them.
- SOC 2 Type II
- Cyber Essentials (UK)
- ISO/IEC 42001, for AI management
We don't hold any of these certificates yet. This page shows where the work stands today.
Legal pages
Each page shows its own version and status. Some are still drafts.
