BlueWhale Stack lets banks, insurers and NBFCs run hybrid and multi-cloud operations on the Enterprise Edition with one identity fabric, one audit trail, bundled observability and cost decomposed by business unit. For Indian institutions, RBI outsourcing directions, CERT-In's 6-hour reporting and 180-day retention, SEBI CSCRF and DPDP obligations are carried at the platform layer — and the mandated exit strategy becomes a rehearsed plan rather than an annexure. Available today.
- 10
- Identity providers federated over SAML / OIDC
- 4
- Regimes mapped — RBI · CERT-In · SEBI · DPDP
- 180 days
- Log retention to CERT-In's requirement
- Mumbai
- In-region residency for regulated workloads
The regimes, and the control that answers each
| Regime | What it demands | The control that answers it |
|---|---|---|
| RBI IT outsourcing directions | Exit strategy for every material outsourcing, concentration risk visible, evidence at inspection | Migration Engine assessment and dependency mapping turn the exit annexure into a rehearsed plan; one inventory shows concentration per provider |
| CERT-In directions (2022) | Incident reporting within 6 hours; 180-day log retention | ITSM P0–P4 SLAs with breach detection; Observe log retention set to 180 days |
| SEBI CSCRF | Continuous control monitoring and periodic evidence | Cloud Audit & Evidence evaluates controls continuously and produces the report per regime |
| DPDP Act 2023 | Personal data localisation and purpose limitation | Mumbai region residency; records pinned in-country and evidenced |
What BFSI teams get
- Federate the bank's IdP and govern access centrally, with maker-checker role separation on approvals
- Keep a full audit trail of every action, so inspection evidence is generated continuously and read from one source
- Turn the RBI outsourcing exit strategy into a dependency-mapped, rehearsed plan with drill evidence on file
- Meet CERT-In's 6-hour incident reporting through ITSM SLAs, and 180-day log retention in Observe
- Run bundled observability without extra contracts, feeding your SIEM and SOC
- Show cost per business unit with Whale AI FinOps narratives the CFO can decompose
- Assess legacy workloads for migration (6R) without touching core-banking internals
- Enforce in-India data residency for payment data and regulated workloads
Use cases
Federated identity with maker-checker
Identity & Access federates the bank's IdP with SCIM provisioning and role-separated approval workflows, and every action is written to the audit trail — evidence for the inspector and the internal auditor from the same source. Modules: Identity & Access, Inventory & Discovery.
The RBI exit plan, rehearsed
The Migration Engine's assessment and dependency mapping turn the RBI outsourcing exit strategy from an untested annexure into a dependency-mapped, rehearsable programme — with drill evidence on file for the supervisor. Modules: Migration Engine, Inventory & Discovery.
Inspection evidence from a system of record
Continuous control monitoring, Observe and centralised activity logging feed audit reports the board and the RBI examiner read from the same source, with retention tuned to CERT-In's 180-day requirement. Modules: Cloud Audit & Evidence, Observe, Whale ITSM.
A cloud bill the CFO can decompose
Whale AI FinOps use cases join billing to the inventory, so each business unit sees its own spend, anomalies are explained against real resources, and payment-peak capacity is planned with a price tag. Modules: Whalenomics, Inventory & Discovery.
Delivered engagement — Two leading banks, Singapore & Qatar
Two banks running public cloud, private infrastructure and on-premises systems under MAS and Qatar central-bank supervision moved from weeks of manual evidence assembly per inspection to reports generated from one policy layer — and rehearsed the exit plans they had only ever documented.
- Weeks → days
- Inspection prep
- 2
- Regulatory regimes, one plane
- Drill evidence
- Exit-plan compliance
“The last supervisory request took three days. Before, it took three weeks of five people pulling screenshots. And the exit plan has now been run as a drill, with the evidence filed.”
Procurement, hosting and integration questions
Can payment and core-banking data stay in India?
Yes. SaaS runs in the Mumbai region, or the platform deploys BYOC or on-premises inside your own perimeter; residency is enforced per resource and evidenced from the audit log.
How does this fit with our existing ServiceNow and SIEM?
Tickets sync two-way with ServiceNow or Jira, and Observe forwards telemetry and findings to your SIEM — the platform adds cloud context rather than replacing the SOC's tooling.
What does the RBI exit-strategy work actually involve?
Edge Agents and connectors inventory the estate, the Migration Engine scores each workload with a 6R assessment and maps dependencies, and the resulting wave plan is rehearsed with drill evidence filed — the annexure becomes a tested plan.
Platform certifications
ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701 and ISO 22301, independently audited by accredited bodies; a CSA STAR Level 1 self-assessment, a GDPR compliance assessment and a SOC 2 Type II readiness assessment. Certificates and verification numbers are in the Trust Center.