Compliance & Safety
Workplace compliance, checked before it is checked.
The five things an office is quietly out of compliance with and does not find out about until a complaint, a vendor audit, a notice or an inspection. POSH is the one with a penalty attached and a hard trigger at ten employees, so it is where most of these start.
On quote scoped before anything is booked
5 audits in this group · take one or take the set
Vybe audits, Vybe certificates. Read this first.
We read your premises, your records and your arrangements against the standard that applies to them, write down what we find, and where the audit passes we issue a certificate and a badge. Every audit here is a Vybe audit and every certificate is issued by Vybe Technologies.
Where an audit names a standard, whether that is FSSAI Schedule 4, the National Building Code, POCSO, the POSH Act, the DPDP Act or the UN SDGs, that names the yardstick we read you against. It is not a claim of approval, affiliation or recognition by whoever wrote it. We are not accredited by, affiliated to, appointed by or recognised by FSSAI, the Fire and Emergency Services, any Pollution Control Board, NAAC, NIRF, the Labour Department, the Data Protection Board or any other authority or certification body.
So our certificate is not a licence, an NOC, a hygiene rating, an accreditation or a finding of legal compliance, it carries no authority’s mark, and it must not be displayed or described as though it did. It is verifiable on our own portal and nowhere else. If somebody is asking your organisation for an official certificate, ours is not it, and we will tell you which body issues the one they want rather than sell you ours instead.
-
POSH Act 2013 standard
Vybe POSH Compliance Audit
Internal Committee, policy, training and the annual report, mandatory at ten employees, with a penalty behind it.
What it covers
- Whether an Internal Committee exists at all, and whether one exists at every office with ten or more employees rather than only at head office
- Its composition: a Presiding Officer who is a woman employed at a senior level, at least half the members women, and an external member from an NGO or with experience of issues relating to sexual harassment
- Whether the external member is genuinely external and is being paid the fees the Rules provide for
- The written policy: whether it exists, whether it says what the Act requires, and whether it has reached anybody
- Display at a conspicuous place of the penal consequences and the Internal Committee’s constitution, which the Act requires and almost nobody does
- The annual report to the District Officer, whether it has been filed, and for which years
- Awareness programmes for employees and orientation for IC members, and the records of both
- The complaint register, the procedure and the statutory timelines, and whether a complaint could be handled without improvising
- Coverage of interns, trainees, contract staff, probationers and people working from home, all of whom count
Read against
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 and the Rules made under it. The obligation to constitute an Internal Committee bites at ten or more employees.
If it passes
Vybe POSH Compliance Certificate and badge, issued by Vybe Technologies, valid one year.
Failure to constitute an Internal Committee or to comply with the Act carries a fine of up to ₹50,000 for a first contravention. On a repeat, the penalty is doubled and the licence or registration under which the business operates can be cancelled or not renewed.
What it is notWe review your arrangements and report on them. We do not sit on your Internal Committee, we do not conduct inquiries into complaints, and neither the audit nor the certificate files your annual report or discharges any obligation under the Act. A Vybe certificate is not a finding of compliance by any authority and would not answer a District Officer. Where you need an external IC member or a lawyer, we will say so.
-
Licence terms & Copyright Act 1957
Vybe Software Licence & IT Asset Audit
What is installed against what is paid for, counted by you before it is counted by somebody else.
What it covers
- An inventory of what is actually installed across machines, against what has actually been bought
- Invoices, licence keys and proof of purchase matched to specific devices rather than kept in a folder called Software
- Per-user versus per-device licensing, and whether the count is genuinely met under the metric that applies
- OEM, retail and volume licensing, and the OEM licence that left with the laptop it was tied to
- Operating system licensing, server licences and client access licences, which is where the money usually is
- Unlicensed, cracked or key-generated installs, including the one on the machine in the corner
- Open-source components used commercially, and whether their licence terms are being met
- Fonts, stock photography and design files, which are licensed assets and are almost never tracked
- Subscriptions being paid for and not used, which is the part of this audit that pays for it
- What happens to a licence when a laptop is reassigned, and when an employee leaves
Read against
Your own licence agreements and the terms of the products you run. The exposure is contractual and under the Copyright Act, 1957, and it typically arrives as a letter from a vendor or from an industry body such as the BSA rather than as a government inspection.
If it passes
Vybe Software Licence & IT Asset Certificate and badge, issued by Vybe Technologies, valid one year.
What it is notWe are not the BSA, not a Microsoft SAM engagement, and not an OEM auditor, and we are not affiliated to any software vendor. Nothing we find is reported to anybody. Our certificate records our own count on a date; it is not a vendor’s clearance and would not settle a vendor’s claim. This is your count, done privately, so that somebody else’s does not surprise you.
-
DPDP Act 2023 standard
Vybe Data Protection Audit
What personal data you hold, why, on whose consent, for how long, and who else has it.
What it covers
- A map of the personal data you actually collect, where it lives, and why you have it
- Notice and consent at the point of collection, in the form the Act requires, rather than a line in a footer
- Where you are relying on a legitimate use rather than consent, and whether that reliance holds
- Retention and deletion: how long you keep things, and whether anything is ever actually deleted
- Processors and vendors, from payroll and CRM to cloud, analytics and that WhatsApp group, and what your contracts with them say
- A data principal’s rights: access, correction, erasure, nomination and grievance, and whether anybody at your end would answer
- Breach readiness: who is told, by whom, in what time, and whether the Board would be notified
- Children’s data and verifiable parental consent, which is a hard requirement and a live problem for anyone running a school or an ed-tech product
- Cross-border transfer, and where your data has quietly been all along
- Employee data, CCTV footage and recruitment records, which are the categories most often forgotten
Read against
The Digital Personal Data Protection Act, 2023 and the Rules made under it.
If it passes
Vybe Data Protection Certificate and badge, issued by Vybe Technologies, valid one year.
What it is notA Vybe gap assessment to the DPDP standard. It is not the independent Data Auditor engagement that a Significant Data Fiduciary must arrange under the Act, we are not appointed or recognised by the Data Protection Board, and it is not a legal opinion. Neither the audit nor the certificate makes you compliant. They tell you where you are not.
-
EPF, ESI & Shops Act standard
Vybe Labour Law & HR Compliance Audit
PF, ESI, Shops and Establishments, contracts and the statutory registers nobody maintains.
What it covers
- EPF and ESI: registration, coverage, whether everybody who should be on it is, and whether contributions match the wages actually paid
- Shops and Commercial Establishments registration, its renewal, and the establishment details on it still being true
- Professional Tax registration for the establishment and deduction for employees
- Appointment letters, and whether their terms match what is actually paid and worked
- Statutory registers: muster roll, wage register, leave, overtime, fines and deductions, and the advances register
- Minimum wages against the rates notified for your scheduled employment and zone
- Working hours, weekly off, overtime rates and the leave the Act entitles people to
- Gratuity and bonus eligibility and provisioning
- Contract labour, and the liability that sits with you as principal employer whatever the contract says
- Maternity benefit, and the crèche requirement above the employee threshold
- The abstracts and notices that have to be displayed, and the ones that have to be filed annually
Read against
The EPF & MP Act 1952, the ESI Act 1948, the Karnataka Shops and Commercial Establishments Act 1961, the Payment of Wages, Minimum Wages, Payment of Bonus, Payment of Gratuity, Maternity Benefit and Contract Labour Acts, and the registers and returns prescribed under them.
If it passes
Vybe Labour Law & HR Compliance Certificate and badge, issued by Vybe Technologies, valid one year.
What it is notA Vybe advisory review. Not a Labour Department inspection, not a statutory audit, and not legal advice; we are not affiliated to any labour authority and our certificate would not answer an inspector. Where a finding needs a lawyer or a labour law consultant to resolve rather than a form to be filed, we say which.
-
NBC 2016 Part 4 standard
Vybe Office Fire & Workplace Safety Audit
The same fire and electrical basics as a campus, scaled to a floor plate.
What it covers
- Exit routes and whether they are clear, which is where an office fails almost every time: cartons in the corridor, a fire door wedged, a second exit that opens into a locked lobby
- Extinguisher type against the risk, placement, pressure and refill dates, and whether anybody on the floor has used one
- Detection and alarm, its audibility in meeting rooms and washrooms, and manual call points
- Emergency lighting, exit signage and the route to the assembly point
- Evacuation drill records, and the fact that most offices have none
- Electrical load against sanctioned load, the DB, and the extension board tree under somebody’s desk
- Server room, UPS and battery room: ventilation, suppression, and what is being stored in there
- Pantry equipment, which is the most likely ignition source in a normal office
- First aid box contents and expiry, and who is trained to use it
- Where you are a tenant: what the building’s fire systems cover, what they do not, and which of the findings are the landlord’s
Read against
The National Building Code of India 2016, Part 4, so far as it applies to a business occupancy, together with the fire requirements in the Shops and Commercial Establishments rules and your building’s own occupancy certificate and fire clearance.
If it passes
Vybe Office Fire & Workplace Safety Certificate and badge, issued by Vybe Technologies, valid one year.
What it is notPreparation and assessment only. We are not the fire department and are not affiliated to it, and neither the audit nor the certificate produces or renews a fire NOC for you or for your building.
In detail
Office & workplace compliance audits
POSH is the one with a deadline already passed
Every other audit here is prudent. POSH is overdue. The obligation to constitute an Internal Committee applies to every employer with ten or more employees, it applied from 2013, and it applies at each office separately rather than once for the company. The penalty for not having one is up to ₹50,000, and for a repeat it doubles and brings the possibility of the licence or registration the business trades under being cancelled. The part that catches people is not the committee, though. It is the rest of it: the external member who has to come from outside, the display of the committee’s constitution at a conspicuous place, the annual report to the District Officer, and the awareness sessions. We have yet to walk into an office that had all five and could show the records.
The software audit usually pays for itself
Not because of the exposure, although a letter from a vendor or from an industry body is an unpleasant way to spend a quarter, but because of what the inventory turns up in the other direction. Almost every office of any size is paying for seats nobody uses, for a subscription renewed by standing instruction for a product replaced two years ago, and for licences tied to laptops that left the building. The count runs in both directions and the second direction is usually the larger number. What we will not do is tell you the exposure is bigger than it is in order to sell you something: where the answer is that you are fine, the report says you are fine.
DPDP is a gap assessment, not a certificate of compliance
Nobody can make you DPDP compliant in a week, and anybody offering to should be shown the door. What is achievable is knowing exactly where you stand: what personal data you hold, whose it is, what you told them when you took it, who you have since given it to, how long you keep it, and what would happen if somebody asked for it back or if it leaked. Most organisations cannot answer more than two of those. The audit produces the answers and a prioritised list, and the first items on that list are usually unglamorous: a retention rule, a vendor contract clause, a grievance address that reaches a person. The certificate at the end says we audited you against the Act on a date. It does not say you are compliant, because that is not ours to say.
What you get, and what our opinion is worth
A written report per audit with a graded finding list, the provision each finding is read against, and a fix list ordered by exposure rather than by ease. Where the fix is a form, a register, a notice or a policy, we can do it as part of the work. Where it needs a lawyer, a chartered accountant, a licensed electrical contractor or an external IC member, we say so and we say it early. None of this is legal advice, none of it is a statutory audit, and the certificate is ours rather than any authority’s. It is a competent outside reading of your position, in writing, before somebody with the power to fine you forms their own.
Report, certificate, badge
What you walk away with.
Every audit produces a report. Where it closes at or above our threshold it also produces a certificate and a badge, both issued by us, and both described below in the plainest words we can find, so that nobody displays one thinking it is something it is not.
The assessment report
The substance of the engagement. Findings with photographs, each cited to the clause, rule or Goal it is read against, graded into what would fail an inspection or hurt somebody, what would draw a comment, and what is worth doing next time round. Then a fix list in that order. This is the part worth paying for.
The Vybe certificate
Issued where the audit closes at or above our threshold. It names the audit, the standard we read you against, the scope, the site, the date and an expiry a year out, and it carries a verification number checkable on our own portal. Signed by us, on our paper, with our name on it and nobody else’s.
The digital badge
A web and print asset for your site footer, your reception wall, an admission brochure or a tender file, carrying the same audit name, date and verification number. It expires when the certificate does, and we ask that it comes down when it does.
What the certificate and badge are not
They are issued by Vybe Technologies and by nobody else. We are not accredited by, affiliated to, appointed by, empanelled with or recognised by FSSAI, the Karnataka State Fire and Emergency Services or any fire authority, any State Pollution Control Board, NAAC, NIRF, the UGC, the Labour Department, the Data Protection Board of India, the BSA, any software vendor, NABCB, any member of the International Accreditation Forum, or any other regulator, accreditation body or certification body.
So the certificate is not an FSSAI licence, approval or hygiene rating; not a fire No Objection Certificate; not a pollution control consent; not a NAAC or NIRF accreditation, score or endorsement; not a vehicle fitness certificate; not a vendor’s licensing clearance; and not a finding by any authority that your organisation is legally compliant. It carries no government, regulatory or accreditation mark, and it must not be presented, described or displayed as though it does.
What it does say is exactly this: that Vybe Technologies audited a named site against a named standard on a named date, and that it met the threshold we publish for that audit. That is a real and checkable statement, and it is the only one being made.
It is verifiable in one place: our own portal, at vybe.net.in/verify. Anyone can check the number and see who holds it, for which audit, against which standard, for what scope and until when. If a customer, a parent body, a tender, a regulator or an accreditation team requires an official or accredited certificate, ours is not it. Ask them what they need before you buy one from us or from anybody, and we will tell you which body issues it.
How it runs
Scoped, walked, written down, re-checked, certified.
The same five beats whatever is being audited. No engagement starts before you have a written scope and a figure, nothing urgent waits for the report, and no certificate is issued before the findings are closed.
-
Step 1
Scope and quote
Tell us what you run and which audits you want. We come back with a scope that says exactly what will be looked at and what will not, and a figure. Nothing is booked until you have both.
-
Step 2
The visit
On site, during working hours, with the place running as it normally does. We open cupboards, read thermometers, ask for records and talk to the people doing the work rather than only to whoever is showing us around.
-
Step 3
The report
Within a few working days: findings with photographs, each cited to the rule or clause it is read against, graded by severity, and a fix list ordered by what actually matters. Anything urgent you will have heard on the day.
-
Step 4
Re-check, then certificate
Work down the list and we come back to confirm in writing what has closed. Pass our threshold and the Vybe certificate and badge are issued, valid a year. Fall short and we say so. A certificate nobody can fail is worth nothing.
FAQ
Questions, answered.
We have fewer than ten employees. Does POSH apply to us?
The obligation to constitute an Internal Committee starts at ten. Below that you still owe your employees a workplace free of sexual harassment, complaints go to the Local Committee constituted by the District Officer rather than to an internal one, and it is worth having a policy and knowing where to send somebody. If you are near the threshold, the sensible time to set the committee up is before you cross it, not after somebody counts.
Does this audit make us POSH compliant?
No. It tells you precisely where you are not, and it can produce the missing pieces: a policy that says what the Act requires, the display notice, the committee constitution, the annual report format, the awareness session. What it cannot do is serve on your Internal Committee, conduct an inquiry, or file anything on your behalf as though we were you. The external member of your IC has to come from outside the organisation and must not be us reviewing our own arrangement. The certificate records that we audited you against the Act; it is not a finding of compliance by any authority.
Is the software licence audit reported to anyone?
No. Nothing leaves your organisation. We are not the BSA, not a vendor’s SAM programme and not an OEM auditor, we are not affiliated to any software vendor, and we have no obligation or incentive to tell anybody what we found. That is the entire point of counting it yourself first.
Is the DPDP audit legal advice?
No. It is a technical and procedural gap assessment against the Act and Rules, written by people who read them carefully, and it will tell you where your practice and the text do not line up. Where the answer turns on a question of law, whether that is a legitimate use applying to you, how a contract should be drafted or whether you are a Significant Data Fiduciary, we will tell you that it is a lawyer’s question rather than answer it ourselves.
Can you do these remotely?
Partly. The POSH, software licence, DPDP and labour law audits are mostly documents, systems and conversations, and a good deal of that can be done remotely with a shorter visit at the end. The fire and workplace safety audit cannot be done remotely at all and we will not pretend otherwise. Outside Bengaluru, the document-led audits travel fine; for the site-based ones, ask and we will tell you honestly whether the travel is worth it to you.
What does a workplace audit cost?
Scoped first, then quoted. Headcount, number of offices, how many of the five audits you want and how much of it can be done remotely are what move the number. A single POSH review for one office is a small piece of work; a five-audit engagement across three locations is not. Tell us the shape of it at legal@vybe.net.in and a scope and figure come back before anything starts.
More audits
The rest of what we audit.
All audits
Every audit we run, across kitchens, campuses and offices.
Kitchen & food business audits
Restaurants, cloud kitchens, bakeries, caterers and canteens, read against Schedule 4.
School, college & institute audits
Fire, canteen, child safety, transport, campus security and a NAAC/NIRF-ready SDG audit, on one campus visit.
Business registrations
GST, Udyam, FSSAI, DPIIT and more, filed for you at a flat professional fee.
More from Vybe
The rest of the stack.
Vybe ERP
Cloud ERP for school and college administration.
Vybe CMS
100% cashless cafeteria ordering and payouts.
Smart Classrooms
Logic interactive flat panels, online class rigs and writing boards.
Workspace & Email
Google Workspace, Microsoft 365, Zoho Mail and student email.
IT & Cyber
Custom software, security and managed IT.
Printing
Everything from business cards to banners, standees and RFID cards.
Media & Events
Event management, photography, videography, video editing per project or on monthly contract, and photo editing.
Business Registrations
GST, Udyam (MSME), FSSAI and Startup India recognition, from ₹199, plus ISO, NSDC consulting and digital signatures.
Manufacturing & Supply
RFID cards from ₹16.50 and NFC from ₹50, made and encoded to your system, IoT asset and energy monitoring, plus Dell, HP, Lenovo, Asus and Apple hardware.