India's DPDP Act 2023 becomes fully enforceable in May 2027 with penalties up to ₹250 crore per incident. Every organisation processing Indian personal data needs an operational consent platform — not a privacy policy — that can produce any specific consent record on demand in under an hour.

I wanted to prove a single engineer could ship the whole thing — consent + identity + cryptographic audit, dual-deployment-mode, multi-tenant — to a standard admissible as evidence under Indian Evidence Act §65B. Not a demo. Not a starter kit. A platform a bank or a regulator could actually rely on.

The bet: most vendors split CMP (consent) and IAM (identity) into separate products that don't talk to each other — an audit-reconstruction nightmare. Unifying them into one audit ledgeris the architecture the DPDP Act actually expects when it talks about "manage, review and withdraw" through a transparent platform.

Every authorization request is also a consent-capture event — the IAM and CMP share a single OAuth 2.0 authorization server, with PKCE-mandatory authorization-code flow and a runtime token-validation endpoint. If a Data Principal withdraws consent, every relying-party application loses access immediately. Enforcement is real-time, not after-the-fact.

Tamper-evidence is the defaultlayer, not a bolt-on. Every consent action writes to an append-only ledger with a SHA-256 record hash chain. Every five minutes, a Merkle root is computed over the new rows and signed with the instance's ES256 private key, then submitted to an external cloud beaconwhich counter-signs with an independent key — meaning an on-premises operator alone can't retroactively forge or alter the audit history. Each checkpoint is additionally RFC 3161 trusted-timestamped via FreeTSA, eliminating any back-dating attack.

Dual-mode architecture: a multi-tenant SaaS deployment for many customer organisations, and a single-fiduciary on-prem lockdown for sovereign-need customers — with the same codebase, the same audit chain, the same forensic verification CLI for regulators.

Live SaaS on three production domains (consentxpert.com, consentaccess.in, consentgrid.in) via Cloudflare Tunnel. Multi-tenant resolution by Host header at the middleware layer; per-tenant branding, language preferences, and integration credentials.

First on-prem enterprise deployment delivered air-gap to a major Indian university last week. Kit-mode installer (docker-load, no internet required), TrustChain instance key generated on first boot, 14-point self-acceptance gate, four-layer single-fiduciary lockdown. Bundled offline forensic verifier binary for independent regulator audit.

85% DPDP Act 2023 compliance across §§4–14. Tamper-evident audit chain admissible under Indian Evidence Act §65B / Bharatiya Sakshya Adhiniyam, 2023. Direct competitor to OneTrust in the Indian market — on a fraction of the headcount.