The team

The team behind Certifyi

Certifyi is built by people who work in compliance, risk management, security and enterprise software. We build for the people who manage audits, risk registers and vendor assessments.

Who we are

We are a product and engineering company working on one problem: making governance, risk and compliance work part of how an organisation runs, so it is not a separate job done once a year before the audit.

Bhaskar

Founder and CEO, Certifyi / Dignep Group

Started Dignep Group in 2018 as an enterprise software development company. Over time the work kept running into the same problem: startups losing deals or missing funding rounds because compliance moved too slowly and cost too much. Certifyi is the direct result of that frustration.

Before Certifyi, he led GRC and AI policy and strategy drafting, AI governance workshops for local government, and enterprise software engagements across Nepal, Australia and the US.

ISO/IEC Lead Implementer
AI Governance
GRC Architecture
SOC 2
Full-Stack Engineering

Core team

Small team. Deep specialisation.

Every person on the Certifyi team has a specific domain they own. No generalists filling in gaps.

Kailash

Co-founder, GRC Lead

Handles control design, framework mapping and weekly client check-ins. Has led ISO 27001 and SOC 2 implementations across fintech and healthtech companies. The person in the room when auditors ask hard questions.
- ISO 27001
- SOC 2
- Control Design
Shreenkhala

Governance and Policy Specialist

Leads Certifyi’s NIST AI RMF and EU AI Act coverage. Writes the governance templates and policy libraries that clients use to build their compliance posture from the ground up. Has worked in cybersecurity for the last eight years.
- NIST AI RMF
- EU AI Act
- Policy Writing
Kishor

Platform Engineer

Builds and maintains the Certifyi GRC platform. Owns the evidence collection pipeline, audit log architecture and integrations. Background in enterprise SaaS and security engineering before joining Dignep Group.
- React / TypeScript
- FastAPI
- DevOps / MLOps
Sapana

Vendor Risk and TPRM Lead

Runs third-party risk assessments and vendor security reviews for clients going through SOC 2 and ISO 27001. Designed the vendor questionnaire library inside the platform and manages security advisory engagements.
- TPRM
- Vendor Assessments
- GDPR
Jay Sharma

Security and Audit Specialist

Leads mock audits and pre-audit readiness reviews. Has worked as an internal auditor and security consultant before moving to the client side. Knows what auditors look for because he used to be one.
- Security Audit
- Mock Audits
- Gap Assessment
Nisha

Client Success and Engagement

Manages the client journey from the first readiness call through to post-certification check-ins. Keeps projects on schedule, translates between compliance teams and engineering, and makes sure nothing falls through during an active audit window.
- Project Management
- Client Success
- Audit Liaison

How we build

Every change to our code passes a multi-stage review that includes security. Auditors rely on what our software records, so we check our work before it ships.

Teams own their modules from start to finish. The team that designs a feature also builds, documents, tests and supports it, so context is not lost in a handover.

What we chose to build

Some of our design choices take more engineering work. Each customer’s workspace has its own database, where a shared database filtered by customer ID would be simpler to run. Each customer runs in its own workspace.

We think that extra work is worth it, because it keeps each customer’s records apart from everyone else’s.

Our teams

Small teams, each owning its part of the product.

Engineering

Teams that build, test, document and run their own modules.
Product

Sets priorities from customer conversations and knowledge of the compliance domain.
Customer success

GRC practitioners who help organisations set up their workspace and prepare for audits.
Security

Looks after the security of our own platform and keeps every security finding in a register until it is fixed.
Design

Designs the screens for detailed work such as audits, risk registers and evidence, without hiding the detail people need.
Partnerships

Works with consulting firms, audit practices and technology partners.

How we make decisions

These guide what we build, how we build it and who we hire.

Check before shipping

A multi-stage review on every change. Fixing a mistake after release costs more than catching it before.
Own the work

Each team owns its modules completely, including design, code, documentation, security and support.
Say what is true today

Our security page says where our own programme stands, including what we do not have yet.
Build for real people

A compliance officer preparing for an ISO 27001 surveillance audit needs different things from a founder setting up SOC 2 for the first time. We build for both.
Respect the domain

GRC is detailed, regulated and has real consequences. The software should be built with the same care.

Questions

About the team

How large is the team?

We are a small team. Our engineers work directly on the platform, and our customer success team has GRC experience.

Where is the team based?

We work across time zones. Much of our work is written and asynchronous, with set times when working hours overlap.

What is the engineering culture like?

Teams own their modules from start to finish. Every change gets a multi-stage review that includes security. There is no separate QA team, because quality is part of building the feature. We expect people to ship code they would be happy to explain to an auditor.

Are you hiring?

Our careers page explains how we hire and how to get in touch, even when no role is open.