How a check runs, from request to deletion
Five stages, in a fixed order. The second one is the person being checked saying yes or no, and nothing after it happens unless they say yes.
The five stages
You raise a request
From your dashboard, a CSV upload, or the APIYou enter the person's name, how to reach them, and whatever identifiers you have: PAN, GSTIN, CIN, date of birth. You write the purpose in your own words, and the person will read it exactly as you wrote it.
Nothing is looked up at this point. Raising a request costs nothing.
The person agrees, or declines
On their own phone, in their own timeThey receive a link by email, or you share it by WhatsApp or SMS. The page shows who is asking, why, every check that will run and which sources are not connected, and their rights. Then they choose.
Consent is captured through DigiLocker, with a one-time code sent to their email, or as a typed signature when there is no email. The record states which, and they are never presented as equal. A refusal is recorded too, so you know they were asked and said no. If they do not answer, they get at most two reminders.
Checks run against connected sources
In parallel, usually under a minuteWhere payment is required it is taken now, after consent and before any lookup. Every connected source is then queried at once. Public sources that are slow to answer are retried; one that fails outright is reported as an error you can re-run at no cost, never as a clear result.
You get a report that names its limits
On screen, as a PDF, or by private linkEach check shows what it found, how confident the match is, and what it does not tell you. A written assessment sits on top, built from published rules rather than judgement, and it refuses to call a report clear when too few checks completed to say so.
You can dispute a finding. The person checked can see that the request exists, who raised it and what they agreed to at /my-data, and can withdraw consent or raise a concern there. They never see your findings.
Everything personal is deleted
30 days after the request, or soonerA daily sweep removes names, identifiers, check results and anything the person wrote. Withdrawal brings that forward to the next sweep. What survives is the bare record that consent was given, so its reference keeps verifying, and the tax invoice, which the law requires.
Where every answer comes from
Read from the live configuration. Nothing on a report comes from anywhere not listed here, and nothing is inferred or generated.
| Check | Source | What it establishes | Status |
|---|---|---|---|
| PAN | Published PAN structure rules, computed offline | Whether the number could be genuine at all. A PAN that breaks its structural rules was mistyped or invented.A well-formed PAN is not a verified one. Nothing confirms it belongs to this person. | Format test only, no registry connected |
| GSTIN | Published GSTIN check-digit algorithm, computed offline | Whether the number was fabricated or mistyped, and whether it agrees with the PAN supplied.A correct check digit does not prove the registration exists or is active. | Check digit only, no registry connected |
| Corporate register | GLEIF global LEI register | Which entity a CIN or GSTIN is registered to, its legal name and status, and whether that matches the name given.The register holds about 382,000 Indian entities, mostly those active in financial markets. Not being found is not evidence of not existing. | Connected, partial coverage of Indian companies |
| Sanctions and watchlists | Didit AML screening, with UN and EU lists as fallback | Whether the name appears on any of 1,300+ sanctions, PEP and watchlists.International designations only. It does not cover Indian criminal records. | Connected, 1,300+ lists |
| News mentions | GDELT global news index | Whether the name appears in published news coverage.Name-based, so it can include unrelated people with the same name. Every mention needs reading, not counting. | Connected |
| DigiLocker identity | DigiLocker (MeriPehchaan) | The person consenting is the identity the government issued, matched against the name and date of birth supplied.Runs only when the subject chooses DigiLocker. Many people, domestic staff among them, do not use it. | Connected, used when the subject opts in |
| MCA directorships | MCA21 via a licensed provider | Directorships held, from the official company register.Not connected. Reports mark it NOT AVAILABLE rather than clear. | Not connected yet |
| Court records | eCourts data via a licensed provider | Court cases matched by name and identifiers.Not connected. A clear report from us says nothing about court cases or criminal history. | Not connected |
What a report will not tell you
Whether someone has a criminal record or a court case in India: no court-records source is connected. Whether they passed police verification, which is a separate statutory process at your local station. Their credit history, income, or marital history. A clear report from us says nothing about any of these.
What it can tell you with certainty
That a PAN or GSTIN was invented or mistyped, because both carry published rules a fabricated number breaks. That a company identifier belongs to a different company than the one named. That the person agreed to be checked, with a reference anyone can verify.
Run one and see the report
Raise a request in about a minute. Nothing is looked up until the person agrees.