Answer an RBI inspection from a system of record.
Banks, insurers and NBFCs run hybrid and multi-cloud estates with one identity fabric and one audit trail — so RBI, CERT-In, SEBI and DPDP evidence comes from the platform, not a spreadsheet.
Built for
- Retail Banks
- Investment Banks
- NBFCs
- Insurance
- Asset Managers
- Fintech
- 0
- Identity providers federated over SAML / OIDC
- 0
- Regimes mapped — RBI · CERT-In · SEBI · DPDP
- 180 days
- Log retention to CERT-In's requirement
- Mumbai
- In-region residency for regulated workloads
Regulatory reality
The regimes, and the control that answers each
RBI IT outsourcing directions
What it demands
Exit strategy for every material outsourcing, concentration risk visible, evidence at inspection
The control that answers it
Migration Engine assessment and dependency mapping turn the exit annexure into a rehearsed plan; one inventory shows concentration per provider
CERT-In directions (2022)
What it demands
Incident reporting within 6 hours; 180-day log retention
The control that answers it
ITSM P0–P4 SLAs with breach detection; Observe log retention set to 180 days
SEBI CSCRF
What it demands
Continuous control monitoring and periodic evidence
The control that answers it
Cloud Audit & Evidence evaluates controls continuously and produces the report per regime
DPDP Act 2023
What it demands
Personal data localisation and purpose limitation
The control that answers it
Mumbai region residency; records pinned in-country and evidenced
Use cases
Four workflows, mapped to the modules that run them
- 01
Federated identity with maker-checker
Identity & Access federates the bank's IdP with SCIM provisioning and role-separated approval workflows, and every action is written to the audit trail — evidence for the inspector and the internal auditor from the same source.
- 02
The RBI exit plan, rehearsed
The Migration Engine's assessment and dependency mapping turn the RBI outsourcing exit strategy from an untested annexure into a dependency-mapped, rehearsable programme — with drill evidence on file for the supervisor.
- 03
Inspection evidence from a system of record
Continuous control monitoring, Observe and centralised activity logging feed audit reports the board and the RBI examiner read from the same source, with retention tuned to CERT-In's 180-day requirement.
- 04
A cloud bill the CFO can decompose
Whale AI FinOps use cases join billing to the inventory, so each business unit sees its own spend, anomalies are explained against real resources, and payment-peak capacity is planned with a price tag.
Reference architecture
Governed multi-cloud for banks and regulated financial institutions
The seven-layer BFSI architecture sheetBanking & Financial Services architecture — open it here, or full screen to read every label
Fig · BFSI — reference architecture
5400 × 3120
Banking & Financial Services architecture
Governed multi-cloud for banks and regulated financial institutions
How to read it
- 1Channels & users — The consoles and portals each persona works in
- 2Digital Experience Layer — Catalog, self-service, metering and SLA per service — multi-tenant by design
- 3Unified Platform Core — Nine modules under one console, one identity, one policy and one bill
- 4Integrations — How the platform plugs into the systems the estate already runs
- 5Estates & data — Every estate managed as one, and the data stores that hold the evidence
- 6Request flow — The seven steps every call takes — identity, policy, orchestration, evidence
- 7Deployment modes — SaaS, BYOC, on-premise, sovereign air-gapped and edge — the same build
Gold-marked for BFSI
Modules that lead
Deployment modes that fit
Plugs into
Core banking & payments · GRC & risk systems · ITSM · ServiceNow · GL & finance feeds · Bank IdP — SSO · API & connectors
Questions
Procurement, hosting and integration questions
01Can payment and core-banking data stay in India?
Yes. SaaS runs in the Mumbai region, or the platform deploys BYOC or on-premises inside your own perimeter; residency is enforced per resource and evidenced from the audit log.
02How does this fit with our existing ServiceNow and SIEM?
Tickets sync two-way with ServiceNow or Jira, and Observe forwards telemetry and findings to your SIEM — the platform adds cloud context rather than replacing the SOC's tooling.
03What does the RBI exit-strategy work actually involve?
Edge Agents and connectors inventory the estate, the Migration Engine scores each workload with a 6R assessment and maps dependencies, and the resulting wave plan is rehearsed with drill evidence filed — the annexure becomes a tested plan.
Next step
Bring your BFSI estate to a working session.
We connect one of your accounts read-only during the session, walk the BFSI workflows above on your real resources, and leave you with the control mapping for your regimes.