Industries
We map what regulators, platforms and customers expect in your industry, then design the brand, product and software to match. One team covers all six disciplines.
Industries we serve
Grouped into eleven sectors, each listing its sub-industries. Search in your team’s own words, or tick up to three industries to compare them side by side.
Tick “Compare” on up to three industries. With none ticked, the six flagship industries are shown.
| Consumer & retail Retail & commerce | Health & life sciences Consumer health | Finance & insurance Financial services | Technology B2B technology | Media, telecom & entertainment Telecom & media | Travel, hospitality & leisure Hospitality | |
|---|---|---|---|---|---|---|
| Sub-industries | Omnichannel retail, Marketplace sellers, Quick commerce, D2C brands, Department & specialty stores | OTC medicines, Vitamins & supplements, Derma & personal care, Wellness brands, E-pharmacy | Retail & digital banking, Digital lending & NBFCs, Payments & fintech, Cards & credit, Microfinance & small-business credit | SaaS, Enterprise software, Developer platforms, Data & AI platforms, Vertical software | Mobile operators, Broadband & fibre, DTH & cable TV, Streaming (OTT), Enterprise connectivity | Hotel groups & brands, Resorts, Independent & boutique hotels, Serviced apartments, Villas & homestays |
| Main measure | Time to launch a season | First-time claims approval | Onboarding completion | Qualified pipeline | Self-service resolution | Direct booking share |
| The way in | Checkout and consent auditSprint · 1–2 weeks | Claims and channel diagnosticSprint · 2–3 weeks | Disclosure and journey auditSprint · 2–3 weeks | Buyer-question and evidence auditSprint · 2–3 weeks | Care-intent and messaging auditSprint · 2–3 weeks | Direct-booking diagnosticSprint · 2–3 weeks |
| Disciplines that lead | Technology & Intelligence, Campaign & Content Design | Brand Design, Campaign & Content Design | Technology & Intelligence, Product & Experience Design, Marketing Technology | Brand Design, AI Design, Product & Experience Design | Technology & Intelligence, AI Design, Marketing Technology | Product & Experience Design, Marketing Technology |
| Rules mapped | 7 rules · 5 areas | 9 rules · 3 areas | 9 rules · 6 areas | 7 rules · 3 areas | 7 rules · 4 areas | 7 rules · 5 areas |
| Shapes most of the work | Payments, Personal data | Advertising & claims, Sector regulator | Sector regulator, Payments, Personal data, Security & incidents | Personal data, Security & incidents, AI governance | Sector regulator, Personal data, Security & incidents | Payments, Personal data |
| Frameworks beyond the baseline | Baseline: the standards every programme meets + GDPR · PCI DSS v4.0.1 | Baseline: the standards every programme meets | Baseline: the standards every programme meets + PCI DSS v4.0.1 · GDPR | Baseline: the standards every programme meets + SOC 2 · EU AI Act · GDPR | Baseline: the standards every programme meets | Baseline: the standards every programme meets + PCI DSS v4.0.1 · GDPR |
| Challenges | Consent and personal data, Payments on the page, Discovery in AI answers, High-volume content, Owning the relationship | Regulated claims, Consent and personal data, Discovery in AI answers, High-volume content, Governed AI | Regulated claims, Consent and personal data, Payments on the page, High-volume service, Audit-ready evidence, Governed AI | Discovery in AI answers, Audit-ready evidence, Governed AI | Regulated claims, Consent and personal data, High-volume content, High-volume service, Audit-ready evidence, Governed AI | Consent and personal data, Payments on the page, Discovery in AI answers, High-volume service, Owning the relationship |
| AI use cases | Variant production with brand checks, Product data enrichment, Shopping assistant | Claims-safe drafting, Health-question answers, Creator content checks | Service assistant that cites policy, Disclosure checker, Plain-language hardship messages | Sales and support assistant, Security questionnaire drafting, In-product AI features | Care assistant with network context, Pre-send template and consent check, Offer copy from one source | Concierge assistant, Rate and content parity checks, Review replies |
Swipe the table sideways for every industry.
Industry × discipline
Our six flagship industries run down the side and the six disciplines across the top. Pick a cell for the capabilities that do the work and the programmes that include it.
01Retail & commerceMarketing Technology
Core: a steady part of most programmes
Lifecycle journeys and loyalty that honour the shopper’s consent in every tool.
Capabilities that do the work
Programmes it belongs to
Regulation map
Our reading of how much each area of regulation shapes a typical programme in each of the forty-one industries, and how many rules we have mapped. Cells with rules open that industry’s rulebook.
Rules named in more than one rulebook or framework list. Baseline rules apply to every industry; their cards list the rulebooks that also name them.
41 of 41 industries · baseline
Ministry of Electronics and ITPersonal data
Part of the baseline: every programme meets it. Named in forty industry rulebooks:
41 of 41 industries · baseline
Indian Computer Emergency Response TeamSecurity & incidents
Part of the baseline: every programme meets it. Named in fourteen industry rulebooks:
41 of 41 industries · baseline
W3C · European UnionAccessibility
Part of the baseline: every programme meets it. Named in fifteen industry rulebooks:
26 of 41 industries
Central Consumer Protection AuthorityAdvertising & claims
In these industries’ rulebooks or frameworks:
19 of 41 industries
European UnionPersonal data
In these industries’ rulebooks or frameworks:
14 of 41 industries
PCI Security Standards CouncilPayments
In these industries’ rulebooks or frameworks:
13 of 41 industries
Advertising Standards Council of IndiaAdvertising & claims
In these industries’ rulebooks or frameworks:
11 of 41 industries
European UnionAI governance
In these industries’ rulebooks or frameworks:
5 of 41 industries
Department of Consumer AffairsSector regulator
In these industries’ rulebooks or frameworks:
5 of 41 industries
Department of Consumer AffairsSector regulator
In these industries’ rulebooks or frameworks:
Across every industry
Industry rules differ, but these apply everywhere. Every brief, build and review is designed to meet them, and we track each one as it changes.
72 hto send the Data Protection Board a detailed breach report, under rule 7 of the DPDP Rules (from 13 May 2027)
Plain-language consent notices, purpose limits, data-principal rights and breach response, designed into forms, CRMs and analytics.
DPDP Act 2023 and Rules 2025; GDPR where EU residents’ data is processed.
Shapes most of the work inRetail & commerce, Hospitals & care providers, Pharma & biotech, Medical devices & diagnostics and 20 more
24 × 24CSS pixels: the smallest target a control may have, under WCAG 2.2 (2.5.8)
WCAG 2.2 AA at minimum: focus never hidden, targets of at least 24 × 24 CSS px, accessible sign-in and no drag-only controls.
WCAG 2.2 AA; the EU Accessibility Act where you sell in the EU (since June 2025).
Shapes most of the work inFilm, music & live events, Airlines & airports, Education & edtech and Government & public services
2.5 slargest contentful paint at the 75th percentile of visits, the “good” threshold
Pages built to the Core Web Vitals “good” thresholds at the 75th percentile of visits.
LCP ≤ 2.5 s · INP ≤ 200 ms · CLS ≤ 0.1.
LLM01prompt injection, the first of the OWASP risks every assistant is tested against
Every AI feature launches with an evaluation set, automatic checks, a named approver where it matters and an audit log.
OWASP Top 10 for LLM Applications (LLM01 prompt injection); ISO/IEC 42001; NIST AI RMF.
Shapes most of the work inMedical devices & diagnostics, B2B technology, Media & publishing, Film, music & live events and 1 more
6 hto report a cyber incident to CERT-In, under its 2022 directions
Threat modelling, least-privilege access, incident runbooks and scanning for vulnerable dependencies and exposed secrets.
OWASP ASVS; ISO/IEC 27001 controls; CERT-In 6-hour incident reporting.
Shapes most of the work inConsumer electronics, Hospitals & care providers, Medical devices & diagnostics, Financial services and 9 more
We build to these frameworks; this is not a claim of certification. If a programme needs certification, we prepare the evidence your auditor will ask for.
Security incidents
Noticing an incident can start several reporting deadlines at once. Choose an industry and a time to see each deadline that applies and when it falls.
Report the incident to CERT-In
Within six hours of noticing a cyber incident, or of being told about one.
Report to the Department of Telecommunications
Within six hours of becoming aware of a security incident, with its relevant details.
Send the Department the further details
Within 24 hours: the users affected, the duration, the systems involved and the action taken.
Send the detailed breach report to the Data Protection Board
The Board and each affected person are told without delay; the detailed report follows within 72 hours of becoming aware.
Notify the EU supervisory authority
Without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach.
Our reading of each instrument, not legal advice: your counsel confirms which windows apply and how. Times are in your own time zone.
How we work with you
The first engagement is short and fixed in scope: it maps where you stand and sets the baseline a programme is judged on. The findings are yours whether or not you continue.
01Week 0
Your industry, its rules and the measure you need to improve. We tell you plainly whether we are the right team.
02Weeks 1–3
A short, fixed-scope engagement for your industry, ending with findings, a baseline and a plan.
03After the way in
A project, milestones or a retainer, shaped by the findings and judged on the same measure.
What each first engagement reviews, what you get and the baseline it sets.
Every way in is a Sprint
What we look at
What you get
What we look at
What you get
The baseline it sets
Time from brief to approved asset
Start here: Claims and channel diagnostic, consumer healthWhat we look at
What you get
The baseline it sets
Drop-off at each disclosure step
Start here: Disclosure and journey audit, financial servicesWhat we look at
What you get
The baseline it sets
Sales-cycle length
Start here: Buyer-question and evidence audit, B2B technologyWhat we look at
What you get
The baseline it sets
Contact rate per thousand subscribers
Start here: Care-intent and messaging audit, telecom & mediaWhat we look at
What you get
The baseline it sets
Booking-flow conversion by step
Start here: Direct-booking diagnostic, hospitalityLengths are typical. We agree yours in the first conversation.
Each industry page starts its programmes with its own first engagement: what it reviews, what you get and where to start.
Questions
Something else on your mind? Ask us directly
Probably. We have mapped the rules and programmes for forty-one industries, and a neighbouring industry usually shares most of its rules with one of them. The first conversation shows which; if the fit is poor, we say so.
They are the six industries we have mapped in most depth. Each has a full rulebook, a row in the industry × discipline matrix and a working deliverable on its page. Every other industry page has the same sections: what changes, the rules, what we build, programmes, AI use cases and questions.
No. We design and build to the rules, which makes your legal and compliance review faster. Every rule on these pages is our reading of the issuer’s own text, dated when compiled; your counsel keeps sign-off.
Each industry page shows when its rules were last compiled, and every rule cites its source. We aim to re-check a rulebook when an issuer publishes a change, and again with your compliance team before a programme starts.
Yes. A group with a lender and an insurer, or a retailer with a pharmacy arm, gets one brand and data foundation, with each industry’s rules applied to the parts they govern.
No. They start with Indian law and add the international rules your customers and partners bring: GDPR, the EU AI Act, the EU Accessibility Act, PCI DSS and WCAG. We map other markets when a programme starts.
AI drafts content, checks it against the rules, answers questions and routes requests. A named person approves what goes live, and a log records each step for supervisors to read. Each industry page lists its use cases and the risk each is tested for.
With the way in for your industry: a short, fixed-scope engagement that maps where you stand and sets the baseline the programme is judged on. The findings are yours whether or not you go further.
You will speak to a lead who would run the work, and get a straight answer on fit.
01About 2 minutes
You get A reply from a named lead
02About 8 minutesRecommended
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
