Financial-services-grade data protection, built in

We work with banks, NBFCs, fintechs, and financial-services GCCs: organisations that are themselves regulated and that assess every vendor's data handling. PeopleCap is built to meet that bar: independently certified, engineered for India's data-protection law, with your primary data hosted in India.

ISO/IEC 27001:2022 certified
Built for the DPDP Act 2023
Primary data hosted in India
Responsible, human-reviewed AI

Why this matters for the firms we serve

Specialist search means handling some of the most sensitive data an organisation has: candidate identities and compensation, hiring plans, and, in our fractional-HR work, an organisation's own people data. Our clients are regulated firms that are accountable for the vendors they use. So we hold ourselves to the standard they are held to: an independently certified security programme, a data-protection posture aligned to Indian law, and a clear answer to the question every procurement and information-security team asks: where does our data go, and how is it protected?

This page is a plain-language overview. Clients and prospective clients running a security or vendor review can request our certificate, sub-processor register, and a fuller security summary under NDA. See the last section.

Certifications and standards

Independently certified, and built ahead of the law.

Information security

ISO/IEC 27001:2022 certified

N53 Techworks LLP, which operates PeopleCap, holds a valid ISO/IEC 27001:2022 certification for the information security management system covering the operations under which the practice is run. ISO/IEC 27001 is the international standard for managing information security through documented policies, risk assessment, access control, monitoring, and continual improvement, verified by an accredited certification body. The certificate is available to clients on request.

Data protection

Built for India's DPDP Act 2023

India's Digital Personal Data Protection Act 2023, and the DPDP Rules 2025 notified on 13 November 2025, bring substantive obligations into force on 14 May 2027. Rather than wait, we have already built and are operating the controls the Act requires: notice and consent, data-principal rights, grievance redressal, breach response, and defined retention. We describe how in our Privacy Policy, and we align our practices as those obligations take effect.

Where your data lives

Our primary candidate and client data is held in India. For regulated buyers who care where their data rests, that is how we are set up, not an add-on.

One thing about processing we would rather state plainly than imply away: a small number of activities use providers that may process limited personal data outside India under contract, principally transactional email delivery and any AI-assisted text processing of the résumé and job-description text needed for parsing and matching. Each of these steps, the category of provider and its purpose, is disclosed in our Privacy Policy.

We run the practice on RecruiterDesk, our own recruitment platform (recruiterdesk.io), operated under the same legal entity, N53 Techworks LLP. Candidate applications and employer briefs submitted through this website are sent to RecruiterDesk so our recruitment and business-development teams can act on them. Because it is run by the same entity, this is not a transfer to an unrelated third party; the personal data involved, and exactly what we send, is set out in our Privacy Policy.

How we protect data

The controls behind every engagement, in plain terms.

Access control

Least privilege, and confidentiality by default

Access is role-based and least-privilege: people and systems see only the data their role requires. One client's information is kept separate from another's, and a confidentiality wall keeps sensitive HR-advisory content apart from anything else.

Authentication

Access provisioned deliberately

There is no public self-signup to our systems; access is granted deliberately, with strong authentication, and sessions expire. Access to personal data is restricted to team members who need it for their role.

Encryption and storage

Encrypted in transit and at rest

Data is encrypted in transit (TLS) and at rest. Uploaded files, including résumés, are held in private storage, not on public URLs.

Audit and monitoring

Logged and monitored

Access and key actions on personal data are logged, and automated monitoring alerts us to failures. Authentication events are recorded distinctly so unusual activity stands out.

Incident response

A documented breach-response process

We maintain a breach register and an incident-response runbook: contain, preserve evidence, assess, notify, and record. Where a breach is likely to cause significant harm, we notify the Data Protection Board of India and the affected individuals in line with the DPDP Rules.

Data minimisation

Held only while needed, then erased

We keep personal data while the recruitment or engagement purpose is live, then erase it, with documents and logs held on defined timers. Erasure removes the identifying data and physically deletes stored files. We hold no dates of birth or age data, and run no behavioural tracking or targeted advertising.

AI, used responsibly

AI helps our team work faster: parsing résumés, structuring information, and suggesting how a candidate fits a role. It does not decide anything about a person on its own. A member of our practice reviews any AI-derived output before it is acted on for a decision that materially affects a candidate or client, and we do not use AI for automated decision-making, profiling, or targeted advertising.

Where a feature sends text to an AI provider, it does so under contractual confidentiality and data-protection terms, and your personal data is not used to train publicly available AI models. Candidates and clients can ask us about AI-assisted processing of their data at any time.

Fair recruitment, and no fees for candidates

PeopleCap is paid by the organisations that engage us to hire. We never charge candidates a fee of any kind: not to be considered for a role, not to be placed, and not to stay in our talent network. We will never ask you to pay to be introduced to an employer. If anyone claiming to represent PeopleCap asks a candidate for money, it is not us, and we would like to hear about it.

We only put a candidate's profile in front of an employer with that candidate's consent for the specific role, we are clear about the opportunity we are discussing, and we recruit without discriminating on any basis prohibited by law. This reflects how recruitment is being regulated in India, including the Maharashtra Private Placement Agencies (Regulation) Act 2025 and the central Private Placement Agency (Regulation) Bill proposed in 2025, which are built around transparency, worker protection, and a prohibition on charging jobseekers.

For security and procurement teams

If you are running a vendor security assessment, we are glad to support it. On request, and under NDA where appropriate, we can share our ISO/IEC 27001:2022 certificate, our sub-processor register, a DPDP readiness summary, and a security overview, and we will work through your information-security questionnaire.

Write to privacy@peoplecap.in for data-protection and security questions. Grievances can be raised with our Grievance Officer at grievance@peoplecap.in. For candidates: your profile is yours. You control your consent, we never share it with a client without your consent for that specific role, and you can withdraw or ask us to delete it at any time. See the Privacy Policy and Terms of Use for the detail.

Trust and security: common questions

Is PeopleCap ISO 27001 certified?

Yes. PeopleCap, operated by N53 Techworks LLP, holds a valid ISO/IEC 27001:2022 certification for its information security management system. The certificate is available to clients on request as part of vendor due diligence.

Where is candidate and client data stored?

Our primary candidate and client data is held in India. A small number of activities use providers that may process limited personal data outside India under contract, principally transactional email delivery and any AI-assisted text processing. All cross-border processing is disclosed in our Privacy Policy.

Is PeopleCap compliant with India's DPDP Act 2023?

The DPDP Rules 2025 were notified on 13 November 2025, and the Act's substantive obligations commence on 14 May 2027. PeopleCap has built its consent, notice, data-principal rights, grievance redressal and breach-response controls ahead of that date, and operates them now. Our Privacy Policy sets out how we handle personal data under the Act.

Does PeopleCap charge candidates a fee?

No. We are paid by the organisations that engage us to hire. We never charge candidates to be considered, to be placed, or to stay in our talent network, and we never ask a candidate to pay to be introduced to an employer.

How does PeopleCap use AI with my data?

AI assists our team with tasks such as parsing résumés and matching candidates to roles. It never makes decisions about people on its own. A member of our practice reviews any output that materially affects a candidate or client. Where an AI tool processes personal data it does so under contractual data-protection terms, and your data is not used to train publicly available AI models.