Enterprise-grade activity monitoring, endpoint security, and data loss prevention for consulting, accounting, and audit firms - gated behind a real compliance review, transparent to every employee, never covert.
No credit card to start. Intrusive features stay off until your own DPIA is recorded.
Custelis is not covert spyware, and it is built so it cannot be run that way. No keylogging, no password or credential capture, no webcam or microphone access, no personal-device monitoring, no hiding the agent from the people it monitors. Every employee sees a tray icon, a monitoring notice, and a self-service portal showing exactly what is collected about them - enforced in code by a privacy guardrail that rejects prohibited capture attempts outright, not by policy alone.
Every claim below is a real, checkable feature in the product today - not a roadmap item.
Built around one job: keep client identities, financial records, and payroll information inside the firm - without turning management into surveillance.
Login/logout, idle vs. active time, application and website sessions - rolled into one timeline per employee, scoped by role and department.
USB, file transfer, email, and cloud-storage rules engine (who / what / where / when), warn-or-block enforcement, full audit trail on every decision - including for Aadhaar, PAN & GST-linked records.
Off by default. When enabled: active-only, capped at 60/hour, exclusion zones, encrypted storage, and every access to a screenshot is itself logged.
A client registry with per-employee access assignments, access-history logging, and an approval workflow before any bulk export. Built specifically for CA, audit & consulting firms.
Behavioral baselines surface "unusual activity" - never automated accusations - with a human always in the loop before any action is taken.
Role-aware, active-vs-idle aware reporting designed against being read as a leaderboard - with a documented misclassification-override path.
A data-principal rights request comes in. Custelis already knows what monitoring data exists on that employee - it drafts a DPDP-appropriate response grounded in the real record counts, ready for review.
The Windows agent and managed browser companion run on company-owned, company-managed devices only - installed by IT, never hidden, always visible to the person using the machine.
Guarded, no-scraping client integrations - each one is a real API client with automated tests, not a mockup. No-op until you supply credentials. See exactly what each one pulls.
"Built" means implemented and automated-tested against a guarded client, not a mockup. Setup is configured by our team during onboarding, not a self-service connect flow yet - Teams/Slack notifications are the exception. Full detail per connector.
Every workspace records its own lawful basis and jurisdiction before screenshots, website tracking, or DLP enforcement can be enabled. Custelis doesn't hard-code legal conclusions - your compliance team does.
No monitoring vendor can claim certified DPDP compliance yet - the Act's Rules are still being notified in stages. What Custelis can claim is narrower and more useful: the actual mechanics the Act requires are already built, tested, and running - not left as a policy document for your legal team to implement by hand.
Employees raise access, correction, erasure, grievance, and nomination requests themselves from the transparency portal, tracked to resolution in an audited admin queue - with an AI-assisted first draft, always reviewed by a human before it's sent.
Record a personal-data breach and Custelis tracks the Data Protection Board's 72-hour clock automatically, flags it if it's running out, and generates the Board-report payload - matching §8(6) as a running system, not a checklist. How it works.
Employee monitoring for legitimate business purposes falls under DPDP §7 as legitimate use, so consent isn't the operative legal basis - notice, security, data-principal rights, and retention still are, and Custelis's default configuration reflects that distinction instead of bolting on a generic consent banner.
DPDP-ready describes what the product implements today. It is not a certification, and it doesn't replace your own counsel's sign-off for your jurisdiction and use case. Want the full breakdown, including the exact staged effective dates and how to check any vendor against them? Read our DPDP-readiness buyer's framework.
No employee-monitoring vendor can claim certified DPDP compliance yet - the Act's Rules are still being notified in stages. Custelis is DPDP-ready: the specific mechanics the Act requires (data-principal rights self-service, the 72-hour breach clock, a legitimate-use configuration instead of a bolted-on consent banner) are built and running today, not left for your legal team to implement by hand.
No. Keylogging and password or credential capture are never implemented - enforced in code by a privacy guardrail that rejects prohibited capture attempts outright, not by policy alone. Screenshots, where enabled at all, are off by default, active-only, capped at 60 per hour, and every access to one is itself logged.
No. The agent runs only on company-owned, company-managed devices, installed by IT in a staged rollout - never on BYOD or personal hardware.
Yes, by design. Every monitored device shows a tray icon and a monitoring notice, and every employee has a self-service transparency portal showing exactly what's collected about them. Custelis is built so it cannot be run as covert software.
They raise the request themselves from their transparency portal. Custelis drafts a DPDP-appropriate response grounded in the actual record counts held on them - a compliance officer reviews and edits it, and nothing is ever sent automatically.
Per employee per month, not per feature - DLP, screenshots, and the DPDP data-principal-rights workflow are included from the Starter plan, not gated behind an "enterprise" tier. See Pricing below for current rates.
Most monitoring vendors gate DLP, screenshots, or compliance tooling behind an "enterprise" tier. Ours doesn't - the DPDP data-principal-rights portal and the 72-hour breach workflow ship on every plan, including Starter. You pay more only for scale and support depth, never for the parts your compliance team actually needs.
SAML/SSO, dedicated data residency, custom retention schedules, a named CSM, and an SLA - priced against your headcount and rollout timeline.
Prices exclude GST. No per-screenshot or per-alert surcharges - every plan's limits are headcount only. No credit card required to start a workspace.
Branding, admin MFA, and a compliance attestation - then invite your team.
Try for free