Sanad · Sovereign Attestation Rail
Sanad Sign is the India-hosted attestation rail for SBOMs, AIBOMs, and compliance evidence — anchored to hardware identity, chained in a tamper-evident Postgres ledger, and verifiable by any auditor without touching our servers. Mandated by CERT-In v2.0 (July 2025), extended across SEBI CSCRF and RBI guidelines. Built for the era where software and AI models both need provenance.
Status: early access · First design partners onboarding Q2 2026 · CERT-In empanelment application in progress
Why Now
01
Government, essential services, software exporters, and BFSI must generate + maintain SBOMs across QBOM, CBOM, AIBOM, HBOM. Living documents, not one-off artefacts. Enforcement active.
02
SEBI CSCRF 2024 and RBI 2024 circulars extend SBOM requirements across banks, NBFCs, AMCs, RTAs, custodians. Every BFSI dev pipeline needs signed SBOM output.
03
Chainguard and Sigstore are US-hosted. Indian government, PSUs, critical infrastructure, and DPDP-constrained BFSI cannot legally use them for sensitive software. India needs its own rail.
04
EU AI Act, India AI governance, DPDP §12/§13 all point to model bill-of-materials. AIBOM is SBOM with a schema extension. We ship one rail that handles both.
How It Works
CycloneDX 1.4-1.6 from Docker/OCI containers, npm / pip / maven / NuGet lockfiles, or Sentinel endpoint inventory. One CLI command, one GitHub Action, or one API call. Every major regulated software stack covered.
Cosign-compatible signed attestations, anchored to TPM 2.0 hardware identity where available. Every signature chained into a tamper-evident Postgres ledger (SHA-256, genesis-anchored). Independently verifiable without querying our database.
Public or private SBOM registries per tenant. Auditors receive 30-day read-only share links. Sub-second verification across the registry.
Open-source verifier SDK (JS / Python / Go) lets auditors, regulators, and downstream consumers recompute the entire chain locally. Zero dependency on Sanad servers at verification time.
One Platform, Pluggable Modules
Every regulated framework becomes an activatable module on the same tenant. You pay for what you need, plug in the next module the day a new mandate enforces. No second integration. No rip-and-replace.
SBOM + AIBOM generation, signing, registry, verification.
SEBI CSCRF compliance — 20 directives, auditor evidence pack.
CERT-In CISG-2024-03 directive tracker + Sentinel agent.
DPDP §6/§8/§11-16 controls, consent records, breach tracker.
DPDP Rule 4 consent-manager infrastructure (go-live 2026-11-13).
RBI IT Framework for banks, NBFCs, payment systems.
IRDAI Cybersecurity Framework for insurers.
Ring-0 WFP driver for hardware-enforced DPDP §16 residency.
About Sanad
Sanad is the flagship product of COGNOSHIFT PRIVATE LIMITED · CIN U85499HR2025PTC130446 · GSTIN 06AAMCC6054B1ZW · Haryana, India. Infrastructure: Supabase ap-south-1 (Mumbai), Vercel edge in Mumbai, all customer data resident in India by default.
Comprehensive patent filing Jan-Feb 2027 · P1 Kernel-Level Sovereign Ingress Filter · P2 Architecture-Agnostic TPM Attestation