Industries
The same six disciplines, applied under very different constraints. We start from what regulators, platforms and customers already expect of your industry — then design the brand, the product and the systems to meet it.
Every industry we serve
Grouped into eleven sectors, each with the sub-industries where the work lands. Search by name, by sub-industry or by the words your team uses, narrow by sector, and tick up to three to put them side by side.
Tick “Compare” on up to three industries. With none ticked, the six flagship industries are shown.
| Consumer & retail Retail & commerce | Health & life sciences Consumer health | Finance & insurance Financial services | Technology B2B technology | Media, telecom & entertainment Telecom & media | Travel, hospitality & leisure Hospitality | |
|---|---|---|---|---|---|---|
| Sub-industries | Omnichannel retail, Marketplace sellers, Quick commerce, D2C brands, Department & specialty stores | OTC medicines, Vitamins & supplements, Derma & personal care, Wellness brands, E-pharmacy | Retail & digital banking, Digital lending & NBFCs, Payments & fintech, Cards & credit, Microfinance & small-business credit | SaaS, Enterprise software, Developer platforms, Data & AI platforms, Vertical software | Mobile operators, Broadband & fibre, DTH & cable TV, Streaming (OTT), Enterprise connectivity | Hotel groups & brands, Resorts, Independent & boutique hotels, Serviced apartments, Villas & homestays |
| The number we move | Time to ship a season | First-time claims approval | Onboarding completion | Qualified pipeline | Self-service resolution | Direct booking share |
| The way in | Checkout and consent auditSprint · 1–2 weeks | Claims and channel diagnosticSprint · 2–3 weeks | Disclosure and journey auditSprint · 2–3 weeks | Buyer-question and evidence auditSprint · 2–3 weeks | Care-intent and messaging auditSprint · 2–3 weeks | Direct-booking diagnosticSprint · 2–3 weeks |
| Disciplines that lead | Technology & Intelligence, Campaign & Content Design | Brand Design, Campaign & Content Design | Technology & Intelligence, Product & Experience Design, Marketing Technology | Brand Design, AI Design, Product & Experience Design | Technology & Intelligence, AI Design, Marketing Technology | Product & Experience Design, Marketing Technology |
| Rules mapped | 7 rules · 5 areas | 9 rules · 3 areas | 9 rules · 6 areas | 7 rules · 3 areas | 7 rules · 4 areas | 7 rules · 5 areas |
| Shapes most of the work | Payments, Personal data | Advertising & claims, Sector regulator | Sector regulator, Payments, Personal data, Security & incidents | Personal data, Security & incidents, AI governance | Sector regulator, Personal data, Security & incidents | Payments, Personal data |
| Frameworks beyond the baseline | Baseline: the standards every programme meets + GDPR · PCI DSS v4.0.1 | Baseline: the standards every programme meets | Baseline: the standards every programme meets + PCI DSS v4.0.1 · GDPR | Baseline: the standards every programme meets + SOC 2 · EU AI Act · GDPR | Baseline: the standards every programme meets | Baseline: the standards every programme meets + PCI DSS v4.0.1 · GDPR |
| Challenges | Consent at scale, Payments on the page, Discovery in AI answers, Content at scale, Owning the relationship | Regulated claims, Consent at scale, Discovery in AI answers, Content at scale, Governed AI | Regulated claims, Consent at scale, Payments on the page, Service at scale, Audit-ready evidence, Governed AI | Discovery in AI answers, Audit-ready evidence, Governed AI | Regulated claims, Consent at scale, Content at scale, Service at scale, Audit-ready evidence, Governed AI | Consent at scale, Payments on the page, Discovery in AI answers, Service at scale, Owning the relationship |
| AI use cases | Variant production with brand checks, Product data enrichment, Shopping assistant | Claims-safe drafting, Health-question answers, Creator content checks | Service assistant that cites policy, Disclosure checker, Plain-language hardship messages | Sales and support assistant, Security questionnaire drafting, In-product AI with evals | Care assistant with network context, Pre-send template and consent check, Offer copy from one source | Concierge assistant, Rate and content parity checks, Review replies in the brand’s voice |
Swipe the table sideways for every industry.
Industry × discipline
Our six flagship industries down the side, the six disciplines across the top. Pick a cell to see what that discipline builds for that industry, the capabilities that do the work and the programmes it belongs to.
01Retail & commerceMarketing Technology
Core — a steady part of most programmes
Lifecycle journeys and loyalty that honour the shopper’s consent in every tool.
Capabilities that do the work
Programmes it belongs to
Regulation map
Our reading of how heavily each area of regulation shapes a typical programme in each of the forty-one industries, sector by sector, and how many rules we have mapped there. Every cell with rules opens that industry’s rulebook at the right place.
Instruments that appear in more than one rulebook or framework list. Where one belongs to the baseline, it applies to every industry, and the card says which rulebooks also name it.
41 of 41 industries · baseline
Ministry of Electronics and ITPersonal data
Part of the baseline: every programme meets it. Named in forty industry rulebooks:
41 of 41 industries · baseline
Indian Computer Emergency Response TeamSecurity & incidents
Part of the baseline: every programme meets it. Named in fourteen industry rulebooks:
41 of 41 industries · baseline
W3C · European UnionAccessibility
Part of the baseline: every programme meets it. Named in fifteen industry rulebooks:
26 of 41 industries
Central Consumer Protection AuthorityAdvertising & claims
In these industries’ rulebooks or frameworks:
19 of 41 industries
European UnionPersonal data
In these industries’ rulebooks or frameworks:
14 of 41 industries
PCI Security Standards CouncilPayments
In these industries’ rulebooks or frameworks:
13 of 41 industries
Advertising Standards Council of IndiaAdvertising & claims
In these industries’ rulebooks or frameworks:
11 of 41 industries
European UnionAI governance
In these industries’ rulebooks or frameworks:
5 of 41 industries
Department of Consumer AffairsSector regulator
In these industries’ rulebooks or frameworks:
5 of 41 industries
Department of Consumer AffairsSector regulator
In these industries’ rulebooks or frameworks:
Across every industry
Industry rules differ. These apply everywhere, and we track them as they change. They are built into every brief, every build and every review, whichever category you compete in.
72 hto send the Data Protection Board a detailed breach report, under rule 7 of the DPDP Rules (from 13 May 2027)
Consent notices in plain language, purpose limitation, data-principal rights and breach response — designed into forms, CRMs and analytics.
DPDP Act 2023 and Rules 2025; GDPR where EU residents’ data is processed.
Shapes most of the work inRetail & commerce, Hospitals & care providers, Pharma & biotech, Medical devices & diagnostics and 20 more
24 × 24CSS pixels: the smallest target a control may have, under WCAG 2.2 (2.5.8)
WCAG 2.2 AA as the floor: visible focus that is never obscured, targets of at least 24 × 24 CSS px, accessible authentication, no drag-only controls.
WCAG 2.2 AA; the EU Accessibility Act where you sell in the EU (since June 2025).
Shapes most of the work inFilm, music & live events, Airlines & airports, Education & edtech and Government & public services
2.5 slargest contentful paint at the 75th percentile of real visits, the “good” threshold
Pages budgeted to the Core Web Vitals “good” thresholds at the 75th percentile of real visits.
LCP ≤ 2.5 s · INP ≤ 200 ms · CLS ≤ 0.1.
LLM01prompt injection, the first of the OWASP risks every assistant is tested against
Every AI feature ships with an eval set, guardrails, a human approval step where it matters, and an audit log of what it produced.
OWASP LLM Top 10 (LLM01 prompt injection); ISO/IEC 42001; NIST AI RMF.
Shapes most of the work inMedical devices & diagnostics, B2B technology, Media & publishing, Film, music & live events and 1 more
6 hto report a cyber incident to CERT-In, under its 2022 directions
Threat-modelled builds, least-privilege access, dependency and secret scanning, and incident runbooks.
OWASP ASVS; ISO/IEC 27001 controls; CERT-In 6-hour incident reporting.
Shapes most of the work inConsumer electronics, Hospitals & care providers, Medical devices & diagnostics, Financial services and 9 more
Frameworks we build to — not a claim of certification. Where a programme needs formal certification, we prepare the evidence your auditor will ask for.
The incident clock
The moment an incident is noticed, more than one reporting window starts. Choose an industry and a time to see every deadline that applies, and when each one falls.
Report the incident to CERT-In
Within six hours of noticing a cyber incident, or of being told about one.
Report to the Department of Telecommunications
Within six hours of becoming aware of a security incident, with its relevant details.
Send the Department the further details
Within 24 hours: the users affected, the duration, the systems involved and the action taken.
Send the detailed breach report to the Data Protection Board
The Board and each affected person are told without delay; the detailed report follows within 72 hours of becoming aware.
Notify the EU supervisory authority
Without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach.
Our reading of each instrument, not legal advice: your counsel confirms which windows apply and how. Times are in your own time zone.
How we engage
The first engagement is short and fixed in scope: it maps where you stand and sets the baseline a programme is judged on. The findings are yours whether or not you continue.
01Week 0
Your industry, your rules and the number you need to move. We say plainly whether we are the right team.
02Weeks 1–3
A short, fixed-scope engagement for your industry, ending in findings, a baseline and a decision-ready plan.
03After the way in
A project, milestones or a retainer, shaped by what the way in found and judged on the same number.
What each first engagement looks at, what it hands over and the number it sets as a baseline.
Every way in is a Sprint
What we look at
What it hands over
What we look at
What it hands over
The baseline it sets
Time from brief to approved asset
Start here: Claims and channel diagnostic, consumer healthWhat we look at
What it hands over
The baseline it sets
Drop-off at each disclosure step
Start here: Disclosure and journey audit, financial servicesWhat we look at
What it hands over
The baseline it sets
Sales-cycle length
Start here: Buyer-question and evidence audit, B2B technologyWhat we look at
What it hands over
The baseline it sets
Contact rate per thousand subscribers
Start here: Care-intent and messaging audit, telecom & mediaWhat we look at
What it hands over
The baseline it sets
Booking-flow conversion by step
Start here: Direct-booking diagnostic, hospitalityLengths are typical, never promised. The first conversation sets yours.
Each industry page opens its programmes with its own first engagement: what it looks at, what it hands over, and where to start.
Questions
Something else on your mind? Ask us directly
Very likely. These forty-one industries are where we have mapped the rules and the programmes; a neighbouring category usually shares most of its rules with one of them, and the first conversation shows which. If the fit is poor, we say so.
The six flagship industries are the ones we have mapped in most depth: a full rulebook, a place in the industry × discipline matrix and a working version of a deliverable on their page. Every other industry page has the same backbone — what is shifting, the rules, what we build, programmes, AI use cases and questions.
No. We design and build to the rules, and we make your legal and compliance review faster. Every rule line on these pages is our reading of the issuer’s own notice, with the date it was compiled; your counsel keeps sign-off.
Each industry page shows when its rules were last compiled, and every rule cites its instrument. We aim to re-check a rulebook when an issuer publishes a change, and again with your compliance team before a programme starts.
Yes. A group with a lender and an insurer, or a retailer with a pharmacy arm, gets one brand and data foundation, with each industry’s rules applied where they bite.
They lead with Indian law and add the international rules your customers and partners bring: GDPR, the EU AI Act, the EU Accessibility Act, PCI DSS and WCAG. Other markets are mapped at the start of a programme.
Drafting, checking, answering and routing — always inside a guardrail, with a person approving what matters and a log a supervisor could read. Each industry page lists its use cases and the risk each one is tested for.
With the way in for your industry: a short, fixed-scope engagement that maps where you stand and sets the baseline the programme is judged on. The findings are yours whether or not you go further.
Tell us what you’re building. We’ll answer straight.
01About 2 minutes
You get A reply from a lead, not a sales queue
02About 8 minutesMost useful
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
