Keep only what review needs
Findings keep the matched field and where it was found. Cookie values from website scans are never stored.
New Registers built for India’s DPDP Act
OptFlow scans your code and websites for personal data, then carries that evidence into the privacy records, assessments, and reports your team maintains.
GitHub repositoriesWebsitesCookies and trackersAPIs and SDKsDatabasesVendorsDPDP registerAssessments
One workspace for the whole privacy picture.
Scroll to bring it into view, then click through the sidebar. This is the product, running with sample data.
Interactive product preview · Use the sidebar to explore
What OptFlow does
Three jobs your team does by hand today, joined by the same evidence.
form.phone in PaymentForm.tsx:29Personal data detected
How it works
Six steps, one body of evidence. Each step builds on what the last one found instead of starting a new spreadsheet.
- 01
Discover
Scan repositories and live websites for personal data, trackers, and outbound transfers.
- 02
Map
Join what the scans found into flows: where data is collected, processed, stored, and shared.
- 03
Document
Turn reviewed flows into processing records, with the source evidence attached.
- 04
Assess
Review risk against the same evidence and record who decided what.
- 05
Monitor
Rescan as the product changes and see which records are affected.
- 06
Report
Export the register and show exactly where each statement came from.
Records written in the language of the DPDP Act
The register follows the Digital Personal Data Protection Act and the 2025 Rules, so what your engineers find becomes entries your Data Protection Officer can sign off.
- Data Principals and purposes
- Retention and cross-border transfers
- Evidence linked to every entry
Checkout paymentsRegister entry
- Data Principals
- Customers placing an order
- Personal data
- Name, email address, phone number, billing address
- Purpose
- Taking payment and sending order updates
- Basis
- Consent given at checkout
- Retention
- 180 days after delivery
- Cross-border transfer
- None, processed in India
- Evidence
checkout-service, 3 findings
How we treat your evidence
Show where data lives
Every record carries its storage and transfer locations, so cross-border questions have an answer.
Version every decision
When evidence changes, the earlier review stays on record next to the new one.
Separate every workspace
Scans, records, and people are scoped to one workspace and never shared across them.
Questions
What is OptFlow?
A privacy operations platform that connects technical data discovery with the records, assessments, and reports privacy teams maintain.
What can I use today?
Repository and website scanning, data-flow mapping, and evidence-linked privacy review. Broader workflows are being added step by step.
Does it support the DPDP Act?
The register is structured around the Digital Personal Data Protection Act and its 2025 Rules: Data Principals, purposes, retention, and cross-border transfers.
How do I get access?
Send an access request below. Once it is approved, sign in with the same Google account email to open your workspace.
Request early access
We review every request and set up a private workspace for your team. After approval, sign in with the same Google account email you enter here.
- Private workspace for your team
- Repository and website scanning
- DPDP-ready register