Every fintech team building voice into their product hits the same wall, and it is never the code. The agent works. The model is fast. Then someone asks who legally owns the number it is calling from, whether the business behind it was verified, and what happens when a regulator asks for proof. Suddenly the launch date belongs to a compliance queue.

At Global Fintech Fest 2026 we are at Booth K25, and this is the conversation we came for.

India spent two years treating the Digital Personal Data Protection Act as something that would eventually happen. That ended in November 2025, when MeitY notified the DPDP Rules and attached real dates.

Consent Manager registration opens 14 November 2026, about nine weeks after GFF closes. Full enforcement lands 13 May 2027 — notice, consent, data-principal rights, security safeguards, breach reporting, retention limits — with penalties reaching ₹250 crore per violation.

For a voice platform this is not abstract. A phone call is personal data. So is the identity of the business placing it. If your onboarding is a folder of PDFs somebody emailed you in 2024, you do not have an audit trail — you have a filing cabinet.

Before speed matters, the boring part has to be true. Indian voice is a regulated activity governed by TRAI and the DoT, and Vobiz runs inside those rules rather than around them.

Only India-registered businesses can hold Indian numbers. A company registered elsewhere uses international routes, at international rates, with an international caller ID. There is no legal workaround, so we don't sell one.

eKYC comes before the number. No Indian number is issued until verification clears. Compliance gates provisioning; it isn't a form you complete afterwards.

Both call legs stay inside India — every leg of a domestic call, and for a conference, every participant. A call that would breach this fails outright. Enforced, not requested.

The number series has to match the call. Using the wrong one is itself a violation, no matter how good your consent records are:

Cold calling is prohibited. Under TRAI's TCCCPR Regulations, 2025, commercial calls need explicit digital consent no older than six months. Calls made without it become UCC complaints, and a high complaint rate leads to suspension or blacklisting by TRAI — a far more expensive outcome than the campaign was ever worth.

Speed is the interesting part. This is the load-bearing part.

The government already runs authoritative, live databases of who every registered Indian business and individual is. If those systems answer the question directly, asking a customer to scan and upload a certificate is a design choice — not a requirement.

So we don't collect documents. We ask the source. There are exactly two paths.

If you are an individual — a founder, sole proprietor, or individual business owner:

If you are a registered business:

That is the entire list. Two checks either way. Nothing to photograph, nothing to sign, no company seal, no support ticket. Each returns in under thirty seconds, and the whole flow finishes in about two minutes without your customer leaving the page.

Elsewhere this is still a console upload, reviewed by someone else's team. Turnaround has genuinely improved, to minutes rather than days. But it still verifies a document rather than an entity. Two things follow from doing it the other way.

We don't store your documents, because we never collect them. There is no PAN card image, no Aadhaar scan, no GST certificate PDF held on Vobiz servers — not encrypted, not in a bucket, not in a backup. The verification is a live query to the government registry and the answer is a yes or a no. Nothing to retain, nothing to hand over, nothing to lose in a breach. That is data minimisation as an outcome rather than a policy commitment, which is exactly what DPDP is pushing every business in this hall toward.

"Verified" means verified today. A certificate is a photograph of a moment, and moments go stale. A business whose GST registration lapsed last quarter can still produce a handsome PDF from back when it hadn't. A live check returns current status, so a lapsed entity fails.

Two acronyms get printed on a lot of banners this week, so it is worth being precise.

ISO/IEC 27001 certifies that an information security management system exists, is documented, and is independently audited. Vobiz holds it across its voice platform and data layers.

One detail worth carrying into every vendor conversation on this floor: the transition to ISO/IEC 27001:2022 closed on 31 October 2025, and certificates issued against the 2013 edition expired then rather than running their usual three-year term. A security page still citing 27001:2013 today is describing a standard that no longer certifies anyone. Ask for the edition and the certificate date, not the logo.

SOC 2 Type II is the harder instrument — not a certificate but an independent auditor's attestation covering a window of time. Type I says a control existed on one day. Type II says it worked all year. Vobiz is audited annually against the Security, Availability and Confidentiality criteria.

The interesting conversations at a fintech conference are rarely the ones on the keynote stage. They are the ones where someone describes the specific way their onboarding breaks.

We are at Booth K25, Ground Floor Pavilion, Jio World Centre, Mumbai, 9-11 September 2026. Bring the awkward version of the question — the business that failed GST validation, the campaign that drew UCC complaints, the auditor who wants evidence rather than assurances.

There is also a 10-minute challenge: sign up, clear eKYC, claim a number, connect your agent, place a live call. Finish it and you're in the daily draw from a ₹90,000 prize pool.

Your agents handle the conversation. We handle the part that has to survive an audit.