When an Indian startup says it is "CERT-In empanelled", or that its product was "audited by a CERT-In empanelled auditor", you can check most of the claim yourself in about fifteen minutes. Download CERT-In's list of empanelled auditing organisations, find the exact firm, read its snapshot page, and then compare the audit certificate the startup shows you against what CERT-In's guidelines say a certificate must contain.
The check matters to two kinds of readers. Buyers, especially government departments, banks and enterprises, often ask SaaS vendors for a recent security audit. Investors and directory editors see the phrase on pitch decks and landing pages and need to know what it actually supports. The short version: CERT-In empanels auditing firms. It does not, in the documents we reviewed, test or certify an individual startup's app.
This is a research method, not legal advice, and it does not decide whether a particular company is required to commission an audit.
What "empanelled" actually refers to
CERT-In, the national agency for cyber security incident response under the IT Act, 2000, maintains a panel of information security auditing organisations. Its Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, dated 25 July 2025) describe the arrangement plainly: CERT-In empanels these organisations "to undertake audits, including vulnerability assessments and penetration testing of computer systems, networks and applications" for government bodies and other sectors.
So the claim splits into two very different statements:
- "We are CERT-In empanelled." Only a security auditing firm can truthfully say this. It means the firm appears on CERT-In's current panel.
- "Our app is CERT-In audited" or "CERT-In certified". For a product company, this normally means an empanelled firm audited a specific application or system at a specific time. The audit and its certificate come from that firm, not from CERT-In.
Neither statement says the product is secure today. An audit is a dated look at a defined scope.
Step 1: Find the firm on CERT-In's list
CERT-In publishes the panel as a PDF linked from its Empanelment page. The document opens by calling itself the "up-to-date valid list" of empanelled organisations and says it is updated as soon as there is any change. The copy we downloaded on 16 October 2026 carried file properties dated 5 October 2026 and numbered its organisations up to 236, each listed as "M/s" followed by the registered name, address, website, contact person and email.
A few habits make the search reliable:
- Download a fresh copy each time. The file is long, nearly 1,000 pages including the snapshot sections, and it changes. A PDF saved six months ago is not evidence of current status.
- Search the legal name, not the brand. Security firms often market under a short name and appear on the list as "Pvt Ltd" or "LLP" entities. Confirm the legal name through the MCA company master data if you are unsure.
- Match the website and city. The list gives a website URL and address for each firm. If the startup's auditor has a similar name but a different domain or city, treat it as a different organisation until proven otherwise.
If a firm that calls itself empanelled is not on the current list, ask when it was empanelled and whether that is still true. CERT-In's guidelines describe graded actions against auditors, from a watch list and suspension to withdrawal of empanelment, so a firm that was once on the panel may not be on it now.
Step 2: Read the snapshot, not just the name
After the numbered list, the same PDF contains a "Snapshot of skills and competence" for each organisation. This is the most useful part and most people never scroll to it. In the snapshots we reviewed, it records:
- the year the firm started doing information security audits;
- a Yes/No grid of audit types, such as web application, mobile app, cloud, network, source code review, and compliance audits;
- the number of audits in the last 12 months, split into government, PSU and private;
- counts of qualified technical staff, by certification;
- named staff deployed for government and critical-sector audits, with their qualifications;
- tools used.
The figures are declared by the firm. CERT-In's audit guidelines tell organisations choosing an auditor to use this snapshot to match their needs against each firm's competence, and they say CERT-In may verify the information independently.
For a verifier, the snapshot answers a sharper question than "is the firm listed?" It tells you whether the firm declares the kind of audit the startup is talking about. A firm marked "No" for mobile app testing is an odd choice to have certified a fintech's Android app.
Step 3: Check the audit certificate itself
When a SaaS startup says its product was audited, ask for the audit certificate, not the full report. Reports contain vulnerability details and should stay private. CERT-In's guidelines make the same point about annual-report disclosures, which should mention audit frequency and scope but exclude vulnerabilities and other confidential detail. The certificate is the right document to share.
The July 2025 guidelines set out what a proper certificate should carry, which gives you a checklist:
| What to look for | What the guidelines say | What it tells you |
|---|---|---|
| Auditor name | Must be a CERT-In empanelled organisation | Cross-check against the current list |
| Signatures | Signed by the Lead Auditor and the Head of the Auditing Organisation | One signature only is a gap worth asking about |
| Who did the work | Reports signed only by staff declared to CERT-In in the firm's snapshot | Look for the signatory's name in the snapshot |
| Version details | Hash values, versions and timestamps of the audited assets should feature prominently | Ties the audit to a specific build |
| Scope and environment | Auditors should clearly mention the environment tested | Tells you whether it was the live app, staging, or one module |
| Date | Auditees are expected to ensure a comprehensive audit at least once a year | An older certificate describes an older product |
Version details are the item most often missing in marketing. The guidelines say developers should avoid changing the audited application after the certificate is issued, and they ask auditees to record hashes, versions and timestamps for that reason. A startup that ships weekly will have moved past its audited build quickly. That is normal, but the honest description is "version 4.2 of our web app was audited in March", not "CERT-In certified".
How to read what you find
Most results fall into one of four patterns.
Firm listed, snapshot fits, certificate complete and recent. This is the strongest outcome. You can say, with a date: "A CERT-In empanelled firm audited the startup's web application (version X) in [month, year]." Avoid adding "secure" or "certified by CERT-In".
Firm listed, but the certificate is thin. For example, one signature, no version or hash, or a scope that covers only the marketing website. Ask what was in scope. A clean audit of a brochure site says little about the product that holds customer data.
Firm not on the current list. Ask when it was empanelled and request the certificate date. If the audit happened while the firm was on the panel, the statement can still be accurate for that date. If the firm was never listed, the claim fails.
No firm named at all. "CERT-In compliant" or a badge with no auditor behind it is a claim you cannot verify. Treat it as marketing until the company names the auditor and shares a certificate.
Questions worth asking a founder
When the paperwork and the claim do not line up, a short email usually settles it:
- Which empanelled firm did the audit, and under what legal name?
- What was in scope: which application, which environment, which version?
- When was the certificate issued, and is a follow-up audit planned?
- Were the findings closed? CERT-In's guidelines expect follow-up audits after vulnerabilities are fixed.
Good founders answer these quickly. Enterprise buyers will ask the same questions during procurement, as we noted in our guide to selling SaaS to Indian enterprises, so it pays to have the answers ready.
Where this fits with other checks
A CERT-In audit is one part of a security story. It is often confused with ISO/IEC 27001 certification, which is a management-system certificate issued by a certification body and checked very differently, as covered in our post on verifying ISO certificate claims. Neither replaces a startup's own obligations around personal data, which we cover in the DPDP Act guide for SaaS companies.
For the order in which to run registry checks across MCA, GST, trademarks and sector regulators, use our source-first verification workflow.
A quick checklist
- Download today's CERT-In empanelment PDF.
- Find the auditor by legal name; match website and city.
- Read its snapshot: does it declare the audit type in question?
- Ask for the audit certificate, not the report.
- Check two signatures, a named Lead Auditor, scope, environment, version or hash, and date.
- Look for the signatory among the firm's declared staff.
- Write the claim with its date and scope, never as "CERT-In certified".
FAQ
Does CERT-In certify apps or websites directly?
The CERT-In documents we reviewed describe empanelling auditing organisations, which then audit applications and systems under contract with the organisation being audited. The certificate a startup holds is issued by that firm.
How long is a CERT-In audit certificate valid?
The guidelines do not attach a fixed validity period to a certificate. They expect organisations to ensure a comprehensive audit of their ICT systems at least once a year, and a certificate only covers the version that was tested.
Can a startup put "CERT-In empanelled" on its website?
Only if the startup is itself an auditing organisation on CERT-In's current list. A product company audited by an empanelled firm should say exactly that, with the auditor's name and the audit date.
The practical rule
"CERT-In" on a landing page reads as government approval, which is why it gets stretched. The documents behind it are public and specific: a list of firms, a snapshot of what each firm says it can do, and a certificate format with two signatures and version details. Cite only what those documents show, with your check date. Founders listing a company can submit it to SuperLaunch with claims their records support. Readers can browse the directory and see our editorial policy for how we handle sources and corrections.
Sources checked on 16 October 2026
- CERT-In: Empanelment by CERT-In
- CERT-In: List of empanelled information security auditing organisations, with snapshots (PDF)
- CERT-In: Comprehensive Cyber Security Audit Policy Guidelines, version 1.0, 25 July 2025 (PDF)
- CERT-In: Guidelines for CERT-In empanelled information security auditing organisations, version 3.0 (PDF)
