Governance & Compliance

Overview

Neostra's Governance & Compliance module provides a comprehensive toolkit for managing privacy assessments, tracking regulatory compliance, publishing privacy centers, and maintaining tamper-evident audit records. It supports the full lifecycle from readiness assessment through ongoing compliance monitoring.

Assessments

Assessment Lifecycle

Assessments follow a structured lifecycle from creation through completion, with support for multi-user assignment and PDF export.

curl -X POST https://api.neostra.io/v1/assessments \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "DPDPA Readiness Assessment - Q1 2026",
    "templateId": "tmpl_dpdpa_v2",
    "brandId": "brand_001"
  }'

curl -X POST https://api.neostra.io/v1/assessments/{assessmentId}/assign \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "userIds": ["user_101", "user_102", "user_103"]
  }'

curl -X PUT https://api.neostra.io/v1/assessments/{assessmentId}/sections/{sectionId}/questions/{questionId}/answer \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "Yes, data encryption at rest is enforced.",
    "evidence": ["evidence_file_001"]
  }'

curl -X GET https://api.neostra.io/v1/assessments/{assessmentId}/export \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/pdf"

Template Management

Assessment templates define the structure of assessments including sections, questions, and scoring rules. Templates support a versioned draft/publish/discard workflow.

curl -X POST https://api.neostra.io/v1/templates \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "DPDPA Readiness Template",
    "description": "Assess organizational readiness for India DPDPA compliance"
  }'

curl -X POST https://api.neostra.io/v1/templates/{templateId}/sections \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Data Protection Officer",
    "order": 1
  }'

curl -X POST https://api.neostra.io/v1/templates/{templateId}/sections/{sectionId}/questions \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Has your organization appointed a Data Protection Officer?",
    "type": "SINGLE_SELECT",
    "options": ["Yes", "No", "In Progress"],
    "weight": 5
  }'

curl -X POST https://api.neostra.io/v1/templates/{templateId}/publish \
  -H "Authorization: Bearer <token>"

# Export template as JSON
curl -X GET https://api.neostra.io/v1/templates/{templateId}/export \
  -H "Authorization: Bearer <token>" \
  -o template_backup.json

# Import template from JSON
curl -X POST https://api.neostra.io/v1/templates/import \
  -H "Authorization: Bearer <token>" \
  -F "file=@template_backup.json"

Readiness Scanner

The Readiness Scanner uses pre-built assessment templates to calculate compliance readiness scores across your organization.

curl -X GET "https://api.neostra.io/v1/assessments/dashboard/summary?brandId=brand_001" \
  -H "Authorization: Bearer <token>"

curl -X GET "https://api.neostra.io/v1/assessments/dashboard/summary?templateId=tmpl_dpdpa_v2" \
  -H "Authorization: Bearer <token>"

curl -X GET "https://api.neostra.io/v1/assessments/dashboard/summary?from=2026-01-01&to=2026-03-31" \
  -H "Authorization: Bearer <token>"

Compliance Frameworks

Neostra ships with pre-seeded regulation data managed through database migrations. The RegulationController provides access to framework details.

# List all regulations
curl -X GET https://api.neostra.io/v1/regulations \
  -H "Authorization: Bearer <token>"

# Get regulation details
curl -X GET https://api.neostra.io/v1/regulations/{regulationId} \
  -H "Authorization: Bearer <token>"

Privacy Centers

Privacy Centers let you publish configurable privacy policy pages for your end users with multi-language support and flexible layouts.

curl -X POST https://api.neostra.io/v1/privacy-centers \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Customer Privacy Portal",
    "brandId": "brand_001",
    "subdomain": "privacy"
  }'

curl -X PUT https://api.neostra.io/v1/privacy-centers/{centerId}/config \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "layout": "LEFT_MENU",
    "theme": {
      "primaryColor": "#1a73e8",
      "logo": "https://cdn.example.com/logo.png"
    },
    "languages": ["en", "hi", "ta"]
  }'

curl -X POST https://api.neostra.io/v1/privacy-centers/{centerId}/publish \
  -H "Authorization: Bearer <token>"

Layout Options

Evidence Vault

The Evidence Vault provides tamper-evident audit logging across the entire Neostra platform. An AuditLoggingAspect automatically captures actions and generates SHA-256 hashes for integrity verification.

# Query audit log
curl -X GET "https://api.neostra.io/v1/audit-logs?action=ASSESSMENT_COMPLETED&from=2026-01-01" \
  -H "Authorization: Bearer <token>"

Permissions

Access to governance features is controlled by granular permissions.

Controller Reference

Governance Setup

The Governance Setup module establishes the foundational governance layer required for DPDP compliance. It ensures organizations have clear ownership and accountability, a formal documented governance charter, and defined internal privacy workflows and escalation pathways.

DPDP-Mandated Roles

Governance Charter Generator

The Governance Charter Generator automatically creates a Data Protection Governance Charter based on the organization's configured governance roles. The charter is the foundational governance document reviewed by regulators, auditors, and internal stakeholders.

Privacy Contact Generator

DPDP requires every Data Fiduciary to provide a publicly accessible grievance redressal mechanism. The Privacy Contact Generator automates the creation, hosting, and maintenance of this contact page.

The privacy contact page displays:

• Grievance Officer name, title, email, and phone (optional)
• Data Protection Lead / DPO details as escalation contact
• Grievance SLA (default: acknowledgement in 3 days, resolution in 7 days, editable per org)
• Submission method (direct email link or "Submit grievance" button linking to grievance form)
• A required DPDP legal disclaimer

Escalation Matrix

SLA Defaults

• Initial acknowledgement to data principal: 3 business days
• Internal escalation to DP Lead for medium/high incidents: 48 hours
• Grievance response: 7 days
• Vendor contract review: 14 days
• Annual governance charter review with reminders at 30/15/7 days