ANVE: the private AI office, on the record. See what that means

ANVE

Private AI glossary · updated 2026-10-16

Data localisation
A legal duty to keep certain data inside the country.

Short answer. Data localisation is a legal requirement that certain data be stored, and sometimes processed, only inside a country. India has no single localisation law; it has specific rules. The Reserve Bank of India’s circular of 6 April 2018 requires payment system data to be stored in a system only in India, with an exception for the foreign leg of a transaction. CERT-In’s directions of 28 April 2022 require logs to be kept within the Indian jurisdiction for a rolling 180 days. The DPDP Rules, 2025 allow the Central Government to require significant data fiduciaries to keep specified personal data, and its traffic data, inside India. This is general information, not legal advice.

01

Residency, sovereignty and localisation

Residency describes where data is. Sovereignty describes whose law and control apply to it. Localisation is the legal duty: a rule that says certain data must stay in the country. A vendor can offer residency without any law requiring it, and a law can require localisation whether or not a vendor offers a matching region.

02

The rules that exist today

As of October 2026 the DPDP Rules are phased in: rules 3, 5 to 16, 22 and 23, including rule 13, come into force 18 months after publication in the Gazette in November 2025, around May 2027.

RuleWho it applies toWhat it requires
RBI circular, Storage of Payment System Data (6 April 2018)Authorised payment system operators and the banks the circular is addressed toThe entire data relating to the payment systems they operate is stored in a system only in India, including full end-to-end transaction details. The foreign leg of a transaction may also be stored abroad
CERT-In directions under section 70B(6) of the IT Act (28 April 2022)Service providers, intermediaries, data centres, body corporate and Government organisationsEnable logs of all ICT systems and keep them securely for a rolling 180 days, within the Indian jurisdiction
DPDP Rules, 2025, rule 13(4)Significant data fiduciaries, once notified as suchEnsure that personal data specified by the Central Government, and the traffic data about its flow, is not transferred outside India
DPDP Act, 2023, section 16, and DPDP Rules, rule 15Data fiduciaries generallyNot a localisation duty: transfers abroad are allowed unless the Government restricts a country by notification or sets requirements for making data available to a foreign State
03

What “only in India” means for an AI tool

A localisation rule covers every copy of the data, not only the main database. For an AI tool that means prompts and answers, uploaded documents, the search index built from them, logs, backups and anything sent to a model. A vendor’s India region that stores data at rest in India but processes prompts elsewhere, as OpenAI’s documentation describes for its India region as of October 2026, may not satisfy a rule that says data must be handled only in India. Ask your adviser.

Check, too, which entity a rule addresses. The RBI circular is addressed to payment system operators and banks. Rule 13(4) applies only to entities notified as significant data fiduciaries, and only to the data the Government specifies.

04

Before choosing an AI tool

  • List your data classes: payment data, client records, health data, employee data, logs.
  • Check the rule for each class with your sector regulator or adviser, and note the date it takes effect.
  • Ask the vendor where each copy lives: prompts, outputs, files, indexes, logs and backups.
  • Ask where the model runs when it answers.
  • Put the answers in the contract, with a written statement of data locations.
  • Re-check when the Government notifies significant data fiduciaries or specifies data under rule 13(4).
05

Where ANVE stands

ANVE keeps data on the box in the office, and its security page (/security) says everything sits in one database on the box. Every model call is logged with whether it ran locally or in the cloud. Cloud models exist only if an administrator adds a provider, and a policy that blocks confidential data from cloud models is not on ANVE yet. The research app’s online lookups and podcast narration through a cloud voice are the other exceptions. The office’s own legal duties remain the office’s, and ANVE has no certifications.

06

Questions people ask

Is data localisation required under the DPDP Act?
Not by the Act itself. Section 16 allows transfers abroad unless the Government restricts a country, and the Act is being phased in over 18 months from November 2025. The DPDP Rules, 2025 add a localisation power for significant data fiduciaries in rule 13(4), which applies from about May 2027.
Is an Indian cloud region enough?
It depends on the rule and the service. A region may store data in India while processing elsewhere, so ask about storage, processing, logs and backups separately.
Does CERT-In require logs to stay in India?
The 2022 directions say logs of all ICT systems must be kept for a rolling 180 days and maintained within the Indian jurisdiction, for the entities the directions address.
What counts as payment system data?
The RBI circular says the data includes the full end-to-end transaction details and the information collected, carried or processed as part of the message or payment instruction.
07

What is not real yet

No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.

Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.