DevSecOps for Fintech Startups in India

Most fintech startups meet RBI, PCI DSS and SOC 2 one at a time, each with its own spreadsheet and its own scramble. That is the expensive way. The controls overlap far more than the frameworks admit, so for the fintechs we work with we build them into the pipeline and AWS accounts once, and the same evidence answers all three. We are a DevSecOps company in Kochi, and this is the service we run for fintech startups across India.

$3B+ Transaction Volume Secured
99.9% Uptime Guarantee
10+ Years Expert's Backing
4 Global Markets

Which of RBI, PCI DSS and SOC 2 Applies to Your Startup?

Usually not all three, and never all at once. The first thing we do with a new fintech is work out which one is actually asking, before anyone spends money on the others.

RBI: When You Hold a Licence, or Run Tech for Someone Who Does

PCI DSS: When Card Data Touches Your Systems

  • Applies to anyone who stores, processes or transmits cardholder data, or could affect the security of the environment that does
  • A payment aggregator also puts its PCI DSS Attestation and Report of Compliance in front of its IT committee under the RBI direction
  • Scope is the cost: the account holding card data, plus every account with a path into it
  • If a gateway's hosted page or SDK takes the card today, keep it that way for as long as the product allows

SOC 2: When a Customer Asks for It

  • Not a law or a licence: an examination by a licensed, independent CPA under the AICPA's attestation standards
  • It usually arrives as a question in a US or UK enterprise customer's security review
  • A Type 2 report includes the auditor's tests of your controls and the results, so the controls have to have run, not just been written down
  • The AICPA proposed new criteria on 28 October 2026. If approved, they apply to engagements beginning on or after 31 December 2027

CERT-In: Everyone, From Day One

  • No licence or customer needed: the 2022 directions apply to you already
  • Cyber incidents reported within six hours of noticing them
  • Logs of your ICT systems kept for 180 days, within India
  • The cheapest of the four to get right, and the one startups most often find missing

What We Build for a Fintech: One Pipeline, Three Auditors

The frameworks ask the same questions in different words. Who can change production? What changed, and who approved it? Can you find out what happened? Can you get it back? This is the setup we put in place for every fintech we work with, in your accounts and your repositories, so the evidence is a query and not a folder of screenshots.

What We Build in the Pipeline

  • CI deploys to AWS through OIDC roles, with no access keys stored in the repository
  • Third-party actions pinned to a full commit SHA
  • Dependency, secret and infrastructure-as-code scanning on every pull request
  • Production deploys behind a protected environment with a named reviewer
  • Signed build provenance, so you can show exactly what ran in production

What We Set Up in Your AWS Accounts

  • An organisation trail writing to a log archive account engineering cannot delete from
  • Logs kept in an Indian region for at least 180 days
  • Card data, if you have it, in its own account behind service control policies
  • Named SSO access for every engineer, ours included, and no shared IAM users

The Evidence We Hand Over

  • Each control mapped once to the RBI, PCI DSS and SOC 2 requirement it answers
  • Evidence drawn from pull request history and CloudTrail, not collected by hand the week before the audit
  • Restores tested on a schedule, with the result written down

The Four Checks We Run First (Run Them Yourself on Monday)

  • grep -rln "AWS_SECRET_ACCESS_KEY" .github/workflows lists every workflow using a stored key that an OIDC role should replace.
  • grep -rnE "uses: [^ ]+@" .github/workflows | grep -vE "@[0-9a-f]{40}" lists every action pinned to a tag someone can move.
  • aws cloudtrail describe-trails --query 'trailList[].[Name,IsMultiRegionTrail,IsOrganizationTrail]' should show at least one trail that is true for both.
  • aws logs describe-log-groups --query 'logGroups[?retentionInDays < `180`].[logGroupName,retentionInDays]', run in each region you use, lists the log groups that delete logs before 180 days.

Where we are not the answer: if a customer wants a SOC 2 report this quarter and you have no card data and no licence, a compliance automation platform and one good engineer will get you there faster than we will. We earn our fee in the second year, when the controls have to have actually run. If you are weighing that engineer against a team, read whether a fintech should hire a DevOps engineer or bring in a team.

This is engineering guidance, not legal advice. Whether a direction applies to your company is a question for your compliance team or counsel.

Built to enable your compliance

SOC 2 Type II ISO 27001 PCI DSS SLSA 3 RBI CERT-In OSWE Certified AWS Certified

Further reading

Is the First Audit Already on the Calendar?

Tell us which one is asking: a customer's SOC 2 request, a card network or an RBI application. We will come back with the gaps in your AWS accounts and pipeline that it would find, in the order we would fix them.

Book a Free Cloud Security Audit