Changelog
What has changed in Gevox
Changes a practitioner would notice or rely on, newest first. Corrections are recorded as corrections.
Improved
More seats on every plan, and team tools from Practice
Practice now includes 2 seats, Suite 3 and Firm 10 (up from 5), at the same prices. Roles, client assignment and the team audit trail work on Practice and Suite as soon as a colleague joins. Extra seats are Rs 1,499 a month on Practice, Suite and Firm.
Improved
Fix works on every vault document, and lands you inside the document
Fix now repairs data processing agreements, vendor risk assessments, grievance policies, retention schedules, employee data policies, breach response plans and DPIAs as well as privacy policies and consent notices, with clauses written as contract terms or in the client’s own voice and every unknown fact left as a highlighted field. Fix in Legal Vault from the Document Analyser now opens straight inside the document with Fix ready, instead of the vault’s library; a click while it opens can no longer land on an empty page; the sidebar shows Legal Vault, not the analyser; and the Fix buttons and Apply respond on hover.
Corrected
Nothing on the Legal Vault screen moves while a document is generated
The tools on the right, the document options on the left, and the Fix, Regenerate and Download buttons now appear the moment Generate is pressed, dimmed until the document is ready, and the page keeps the document’s width throughout. Before, they vanished while the text was written in and came back afterwards. A document generated while the tab is in the background is shown in full straight away instead of waiting to finish writing itself out. Fix never adds the same section twice, and the word count follows edits.
Added
Fix: repair an existing document in place
The Document Analyser has a Fix in Legal Vault button. It opens the document in the Legal Vault as a new version of the same document, with a glowing Fix button beside Regenerate whenever Check finds something red or mustard. Fix changes only what Check found, with fixed wording and the client’s own details: it adds what is missing, takes out wording that cannot stand (such as consent by merely using the site), and completes what is weak, and it keeps every other word. Each change is tried first and kept only if Check confirms it helps and nothing else gets worse. You see every change, numbered as in Check, and untick any you do not want before applying; afterwards Track shows exactly what moved and the version before the fix stays in History. Facts Gevox does not know are left as highlighted fields for you to fill in. No AI is used.
Improved
The other seven vault documents follow the same trust rules
The grievance officer letter, retention schedule, employee data policy, breach response plan, data processing agreement, vendor risk assessment and DPIA now keep gaps and any answer not yet written into the text in the practitioner notes, where they are never downloaded or copied, instead of printing them in the document. Section numbers run without gaps when a section is left out. Each document shows its working: every section with the answers it carries and the provisions it cites. The breach plan now writes out its escalation matrix (who hears at each severity, and how fast), which it used to list as raw answers, and no longer promises an annual review nobody chose. The data processing agreement asks for the audit fix period, the time to pass on a request and the cure period; where they are left blank, its proposed terms are listed in the notes to confirm with the client. The employee policy says grounds for processing, and the DPIA says higher-risk data, in place of terms from other laws.
Added
Show the working, and a warning before downloading a document with open problems
A generated privacy policy or consent notice now lists, in its practitioner notes, every published section with the answers it was built from and the provisions of the Act and Rules it meets, so each clause can be traced before sign-off. Download in the Legal Vault now says when Check still finds something to change or add, or something to settle before publishing, with a link straight to it. You can still download.
Improved
Findings are numbered and open one at a time
In the Document Analyser and the Legal Vault Check, every finding carries a number that stays the same whatever filter is on, and opening one closes the one before and brings it into view, so the list no longer grows past where you are reading. A finding opened by clicking a coloured passage can now be closed, and the group headings no longer spill their hover colour behind the document. While a vault document is being generated, the tools on the right stay in place and the loading page is the same size as the document.
Improved
Privacy policy and consent notice rebuilt so a practitioner can sign off on them
Every time, date, link and commitment in the two published notices now comes from the client’s answers or from the Act, never from a default. Each answer has a proper place in the text instead of a list of raw lines at the end. The wording is DPDP only: "grounds for processing", no "lawful basis", no "sensitive personal data" and no foreign transfer clauses. The policy is itemised purpose by purpose (data, ground and retention for each), names the client’s processors and transfers from its register, carries the real withdraw and rights links, offers its languages under Section 5(3), and gives the Section 5(2) notice to people who gave data before the Act. The consent notice gives the main purpose and every optional use its own unticked box, with Decline as prominent as Continue. Gaps, deployment notes and record details now sit under "Practitioner notes", which the vault shows but never downloads, copies or checks as published text. The intake wizard asks for the purpose rows, both links, the languages and existing users, and drops the GDPR options.
Corrected
Privacy policy promises that did not come from the client
The policy promised grievance acknowledgement in 48 hours and resolution in 30 days whatever the client answered, ignored the effective date given, said non-essential cookies were off by default even when they were not, suggested withdraw and rights pages that might not exist, and linked the MeitY home page as the Board complaint channel. New documents use the client’s own times (or the 90-day limit in Rule 14(3) when none is given), its effective date, only the cookie claim its answers support, its own links (a missing one stays a visible placeholder the Check flags), and describe the Board’s complaint route without an unverified link. Documents generated before 10 October 2026 keep the old text until regenerated.
Improved
Legal Vault workbench: the document first, tools beside it
An open document now fills the screen and is the only thing that scrolls. The tools used while reading (Read, Edit, Track, Check, the clause library and version history) sit as icons in a column on the right that never moves, each explained on hover, with a count of findings on Check. Everything else (contents, copy, company details, format, intake, Rule 3 links and delete) is in a fixed list on the left, where short choices pop out beside the list and only forms open a window on the right. Download is back at the top right, with Regenerate beside it.
Added
Clause library in the Legal Vault
Thirteen vetted DPDP clauses, each citing the provision it rests on: notice to people who consented before the Act, languages, separate consent for optional uses, withdrawal, Consent Managers, children and persons with disability under the amended Section 9, Data Processors, transfers outside India, nomination, grievances within the 90-day limit, breach intimation, erasure with the 48-hour warning, and the Data Principal’s duties. A clause fills in the client’s name, officer and email, adds to the end of the document or copies for pasting in Edit, and leaves anything still to supply as a highlighted field that the Check view flags until it is filled in.
Corrected
Privacy policy wording on guardians under Section 9
The privacy policy template said Section 9 covers "persons with a lawful guardian". Section 9(1), as amended by the Removal of Difficulties Order, 2026, covers a child, or a person with disability who has a lawful guardian, and new documents now say so. A document generated before 8 October 2026 keeps the old sentence until it is regenerated or edited; the new Check view flags it.
Added
Compare any saved version of a document
Version history in the Legal Vault now has Compare: Track then shows the document against the version you pick, with removed text struck through in red and added text in green, and one click returns to comparing against the original.
Added
Check: the Document Analyser’s rules on every Legal Vault document
A new Check view in the Legal Vault runs the Document Analyser’s fixed rules on the document you have open, in your browser, with the same findings, teaching and marked-up page. It adds checks only the vault can make: placeholders still to fill in, intake answers printed as raw lines, links the vault filled in by default, a grievance timeline stated twice with different numbers, and provisions the document cites that were amended after it was last edited.
Security
Links in the Legal Vault editor accept only web, email and phone addresses
In the Edit view, a link written into a document could carry markup into the page of whoever opened it for editing. Link addresses now have their quotes escaped, and only web, email and phone links become live; anything else stays as plain text.
Corrected
Saving an edited document no longer renumbers its sections
Saving from the Legal Vault’s Edit view rewrote a numbered line that stood on its own, such as a section heading, as "1.", because the editor rebuilt each one as a fresh numbered list. Numbers are now kept exactly as written. If you edited and saved a document before 8 October 2026, check its section numbers.
Improved
Legal Vault documents on a modern page, the same in Read, Edit and Track
Documents in the Legal Vault now read on a cleaner white page in the app’s own typeface: a real title, section headings in small capitals with green numbers, lists that show their bullets and numbers, and tables that scroll on a phone instead of being cut off. Read, Edit and Track now draw exactly the same page, so switching modes no longer changes the layout, and Track shows removed text struck through in red beside added text in green, where before it showed only additions. The company details fields use the same typeface as the rest of the app, and the Document Analyser uses the same page.
Corrected
Consent by use caught when a notice says "this policy"
The Document Analyser missed a consent-by-use clause when the sentence named the notice rather than personal data, as in "By using this website you agree to this policy". In a privacy or cookie notice that sentence is now marked red under Section 6(1). Terms of service are unaffected: agreeing to terms by using a service is a contract point, not consent to processing.
Improved
Document Analyser shows the document on a white page
The Document Analyser now shows the document on a white sheet with dark serif text, the same page the Legal Vault uses, so a client’s document reads like paper in hand. The colours read as highlighter on the page: red, mustard, green and cyan tints, with the exact trigger words in bold. A PDF keeps its pages as separate sheets, each marked with its page number.
Improved
Act pages updated for the Removal of Difficulties Order, 2026
The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) made two textual changes to the Act, in force from its Gazette publication dated 6 October 2026. Section 9(1) now plainly covers the personal data of a child, and of a person with disability who has a lawful guardian, so a disability alone does not call for guardian consent. Section 10(2)(c)(ii) now requires a periodic data audit rather than a periodic audit. The Section 9 and 10 pages carry an Amended note, and the Significant Data Fiduciary toolkit, the intake guidance on guardians and the Document Analyser use the new wording.
Improved
Document Analyser rebuilt: the whole document, marked up
The Document Analyser now shows the whole document marked up in place: red where wording conflicts with the Act or the Rules or something required is missing, mustard where it is there but needs work, green where it meets the standard, with the exact trigger words in bold. Each finding opens into the law, why it matters, how to fix it with model wording to adapt, what to check on the live site and how the rule decided. It reviews 17 types of document, from privacy notices, consent forms, terms and cookie notices to processor contracts, vendor lists, grievance and rights procedures, retention schedules, security policies, breach plans, data maps, DPIAs and app store data-safety listings, and walks through screenshots of a consent flow item by item. Documents can be uploaded directly (PDF, Word, Excel, CSV or text), opened from the client intake, or pasted. The review uses fixed rules and no AI model, and answers it supports can be added to the client intake once you accept them.
Added
Trust pages for clients, with a badge
A practitioner can publish a public page for a client at gevox.in/trust: where the privacy notice is, who answers questions about personal data (s.8(9), Rule 9), how to raise a grievance (s.8(10), s.13) and the date the practitioner last reviewed it, with a small badge for the client’s own site. It goes public only once a named person at the client has authorised it, and it never says the client is compliant or shows a score. Monthly and yearly plans.
Added
Directory profiles for practitioners
Practices on a monthly or yearly plan can publish an opt-in profile in the Gevox directory of DPDP practitioners from Settings, Directory profile: services, city, sectors and how to reach them. Gevox reads every profile before it is public, and a profile leaves the directory if the plan ends.
Improved
Client readiness, not the website score, beside each client
The client switcher now shows each client’s readiness: the share of everything Gevox tracks for that client, from intake through obligations, documents, registers and evidence, that is done. It is the Command Centre’s figure, computed live for the client you are working on. A website scan alone no longer stands for the client, and the Overview places a client in Compliant only at readiness 100 with no open scan findings. The scan gauge reads Low risk rather than Compliant at the top band.
Corrected
New scan stays new
After pressing New scan, leaving the Website Scan page and returning showed the previous scan again. The page now remembers the choice for that client until a newer scan exists.
Corrected
Our own privacy notice and sub-processor list
Our privacy notice now names each right under Sections 11 to 14 and says how to use it, as Rule 3(c) requires of a notice. It and the sub-processor list wrongly said our AI provider drafts documents and analyses scans: it serves only two business-workspace features, the audit analyser and the clause check, while documents and scan findings come from fixed templates and fixed checks. Resend, which delivers our service emails, is now listed. The scanner also now recognises plain-English descriptions of the rights, such as "correct or erase".
Added
Pages for GRC consultancies and virtual DPOs
Two practitioner pages: one for GRC and information security consultancies, setting the Rule 6(1) security minimum beside the evidence such firms already hold and the CERT-In and DPDP breach clocks side by side; one for virtual DPOs, setting out what the Act requires of the role and how the monthly service runs across many clients.
Corrected
Rule 6 cited with its sub-rule
Rule 6 of the DPDP Rules 2025 places its seven security safeguards in sub-rule (1). Citations across the site, the dashboards and generated documents gave the clause letter without the sub-rule; they now read "Rule 6(1)(e)" and so on, as notified. A test prevents the short form returning.
Improved
Template pages show what Gevox generates
Each of the eight DPDP template pages now carries an unedited excerpt of the document Gevox generates, for a fictional client, beside what the law requires of it, and links the free tool that fits: the notice checker or the deadline calculator.
Corrected
Processor and notice citations
Generated data processing agreements, vendor risk assessments and DPIAs cited Section 8(6), the breach-intimation duty, for the Data Fiduciary’s responsibility for its processors. They now cite Section 8(1) for that responsibility, Section 8(2) for the processor contract and Section 8(5) for security diligence. The privacy notice template now cites the Rule 3 clauses in their notified order: (a) independently understandable, (b) itemised data and purposes, (c) withdrawal, rights and complaint to the Board. Tests now prevent both errors.
Added
Comparisons with OneTrust, Securiti and GRC platforms
Three pages set Gevox beside OneTrust, Securiti, and GRC platforms such as Sprinto and Scrut: what each is built for, in each vendor’s own words, price, how many clients a practitioner can run, when to choose each, how they work together, and where Gevox falls short. Sources are linked and dated.
Improved
A clearer 72-hour breach dial
The deadline calculator’s breach clock is now a dial with one mark per hour: hours spent fade, hours left stay lit, and a strip shows which of the three days the clock is in.
Added
DPDP privacy notice checker
A free tool at /dpdp/notice-checker. Paste a privacy notice and it checks the text against Section 5 and Rule 3, requirement by requirement, highlighting the words each finding rests on and citing the provision. It uses the same phrase rules as the website scanner and runs in the browser; the text is not sent anywhere.
Added
DPDP deadline calculator
A free tool at /dpdp/deadline-calculator. Enter a date and it works out every clock the DPDP Rules 2025 attach to it: the 72-hour breach report to the Board, the 90-day grievance ceiling, the erasure date and 48-hour warning for Third Schedule platforms, one-year log retention, the SDF cycle and the commencement dates, each cited to its rule. Duties due without delay show time elapsed, not an invented deadline. Results can be added to a calendar or shared as a link.
Added
DPDP software for practitioners, compared
A comparison of the DPDP tools built for practitioners serving many clients: client limits, published prices and cost per client as charged, white-label, how each produces its findings and where data is held, each read from the vendor’s own page. Reviewed monthly; vendors can send corrections.
Improved
Site menus
The site header now opens menus for Product, Solutions, Resources and Company, so the practitioner pages, the DPDP reference, the Readiness Index and the comparisons can be reached from any page.
Corrected
Readiness Index: duties a visitor can see
After the 3 October relabel of the Section 8(9) check, the Readiness Index read that figure as 80% instead of 60%. It now reads the correct figure, and an automated test checks every figure the page looks up.
Corrected
Plans start at five client workspaces
The homepage said plans start at three client workspaces. Plans start at five, on Solo. Three is the one-time Starter Pass, which is not a plan.
Improved
White-label stated on the plans that include it
Suite and Firm have always carried the practitioner’s own branding on client-facing reports. The pricing and practitioner pages now say so in those words.
Added
Author and last-updated date on every guide
Each practitioner page and DPDP guide now names its author and the date of its last substantive revision.
Corrected
Citation audit against the official text
All 3,716 DPDP citations in the product were checked against the Act as passed and the DPDP Rules 2025, and more than a hundred were corrected. Among them: breach intimation is cited to Section 8(6) and Rule 7, not Section 40; the Section 8(9) check is described as the published privacy contact, not a grievance contact; the penalty Schedule is numbered in its official order, items 1 to 7; the generated DPIA no longer states a duty to consult the Data Protection Board, which the Act does not impose; and Board addresses that do not exist were removed. An automated test now prevents these errors from returning.
Improved
Plan expiry reminder
The reminder shown in the last seven days of a plan now names the plan and counts the days from its actual end date.
Improved
Faster dashboard pages
Each dashboard page now makes one access check instead of up to four, and requests no longer wait behind one another. Navigation shows progress at once.
Improved
One typeface across the product
The product and the site use a single typeface in sentence case, with monospace kept for figures, dates and section numbers.
Added
Practice-wide search and a count of what is due
The dashboard header carries the client switcher on every page, a search across sections of the Act, glossary terms, every client’s documents, rights requests, breach records and tasks, and a count of what is overdue or due now across all clients.
Added
Legal notices and open-source licences
The operator, trade marks, licence terms and the open-source software Gevox uses are published at /legal and /legal/open-source.
Added
Extra seats and client slots; Firm bought directly
Extra seats (Suite and Firm) and extra client slots (Practice and above) can be bought on their own. A firm can buy the Firm plan itself, without a call.
Added
Due This Week, across every client
One list of every statutory deadline falling due, across all client workspaces, each with its clock.
Added
Pages for practitioners
Pages for consultants, CA firms, company secretaries and law firms, a task-by-task comparison with spreadsheets, and guides to delivering a DPDP engagement and a retainer.
Improved
Website assessment: 16 checks to 22
Every scan now runs 22 checks, including the cookie inventory, browser storage, device fingerprinting and session recording, with further checks for sites that serve children.
Added
Continuous monitoring and the Gap Assessment
Each client’s website is re-examined on a schedule, with a monthly report of what changed. The Gap Assessment report reads the client’s record and sets out what remains open.
Corrected
No score for a site that could not be read
A site the scanner could not load now receives no score, and the scanner no longer reports checks it did not run.
Security
Client intake answers
Closed a path by which text entered in a client intake form could run in the browser of the professional reading it.
Added
DPDP reference: guides, templates and glossary
Sector guides, document templates, answers to common questions, and a glossary of the terms the Act defines, each cited to the section.
Added
Public website scanner and the Readiness Index
Any public website can be assessed without an account. Edition 1 of the DPDP Readiness Index reports, in aggregate, how twenty websites of firms advising on the DPDP Act scored.