Governance

A real entity, named people, a stated posture.

This page exists so that nothing here has to be taken on trust. The company, its officers, what it does with data, where that data sits, and the regimes its platforms operate under — each one stated plainly enough to be checked.

The entity

Stactray Private Limited
Office No. 101, Cabin No. 2, TBL Space, Rayana Group – A Wing,
Survey No. 33/2, Mitcon School, Near Stylus Apartment,
Baner Gaon, Pune, Maharashtra 411045, India
CIN U74909PN2024PTC231186

A private limited company incorporated in Pune in 2024 under the Companies Act, 2013. The CIN resolves publicly at the Ministry of Corporate Affairs, and it is printed here rather than omitted because it is the first thing a serious reader checks.

Officers

Sandeep MustiChief Executive Officer. Signatory for the company.
Sunil MustiCo-Founder. Strategy and Product.

Two people are accountable for what the group publishes and for what it signs. Where a platform holds its own contracts, it does so under its own name, and the company behind it is this one.

Data posture

Stactray Private Limited is the data fiduciary for this website under the Digital Personal Data Protection Act, 2023. The posture is short because the site does very little.

What this site collects

Aggregate traffic measurement through Cloudflare Web Analytics: no cookies, no cross-site tracking, no advertising identifiers, and no personal data. There is no account, no login, no payment and no form. Nothing on this site accepts a submission, so nothing on this site collects one.

Contact and grievances

Questions about data, including any request concerning personal data, go to enterprise@stactray.tech, which is read by a named officer of the company rather than by a queue. Correspondence arriving there is retained only as long as it takes to answer it and to keep an ordinary business record of having done so.

The platforms are separate

Each platform in the portfolio handles its own data under its own terms, and this notice does not extend to them. A platform that processes personal data states its own posture on its own surface, where the obligation actually sits.

Infrastructure

The group builds India-resident. Platform data is held in Indian regions, and the design intent across the portfolio is that data stays in the jurisdiction whose law governs it.

This website is static. It is served from a global content network with no application server, no database and no user state behind it — which is also why its data posture above is as short as it is.

Delivery assurance

The sections above state what the company is. This one states how the work is governed — the part a procurement function asks about, and the part most groups leave to a sales conversation.

Nothing is graded by the person who built it.

Mechanism. A build opens against written acceptance criteria and is closed by a reviewer holding those criteria rather than the intent. The grade is sceptical by default: a thing is not working until it has been shown working.

Artefact. The grade, retained against the build it closed.
Every decision can be re-examined later.

Mechanism. A decision record states the alternatives considered, the reason one was chosen, and what would have to change for it to be reopened.

Artefact. A dated decision record, kept whether or not the decision turned out to be right.
Customer data is isolated by default, not by configuration.

Mechanism. Data, identity and audit trail are separated per customer at the platform boundary. A boundary that has to be switched on is a boundary somebody eventually forgets to switch on.

Artefact. The boundary, its interface and its data contract, specified before the component is shared.
The work is built against named standards.

Mechanism. Digital Personal Data Protection Act, 2023 and India Stack — DEPA, Account Aggregator and ONDC. NIST Cybersecurity Framework. OWASP ASVS. W3C Verifiable Credentials. OpenAPI. WCAG 2.2 AA, checked by the build rather than by an audit afterwards.

Artefact. The standards are named so a reader can check them against the work. Standing under none of them is claimed — the register below states that distinction in full, and it holds here too.

Regulatory register

This register names the regimes the platforms operate under. It does not assert that the company or any platform is registered, licensed, certified, approved or cleared under any of them. Naming a regime is a statement of fact. Implying standing under one is not, and the difference is the whole point of the register.

Regimes by platform
Across the group	Companies Act, 2013 — as a private limited company. Digital Personal Data Protection Act, 2023 — wherever personal data is processed.
ParcelIQ · Within	Serve promoters and contractors whose projects fall under the Real Estate (Regulation and Development) Act, 2016 and the corresponding state authority. The obligation to register a project is the promoter’s; the software supports it.
Dry Powder	Built for managers of funds constituted under the SEBI (Alternative Investment Funds) Regulations, 2012. The fund and its manager carry the registration.
CO‑LLATERAL	Addresses the tokenisation of real-world assets, a subject governed in India by the Securities and Exchange Board of India and, at GIFT City, by the International Financial Services Centres Authority. No product is offered to the public.
One	Supports investor onboarding, which sits under the Prevention of Money-Laundering Act, 2002 and the KYC obligations of the regulated entity performing it.
ReferenceDa™	Deliberately outside two regimes, and this matters more than what it is inside: it is not a credit information company under the Credit Information Companies (Regulation) Act, 2005, and not a credit rating agency under the SEBI (Credit Rating Agencies) Regulations, 1999. It assembles public record and supplies it to a creditor who makes their own decision.
Pramaana™	Operates where laboratory-grown diamonds are described and disclosed: the Bureau of Indian Standards terminology requirements, and the disclosure rules of the export markets a consignment is sold into. It records what a party asserts and the evidence for it; it does not grade, and it does not certify.

Regimes are named as they applied when this page was last reviewed. A regime named here is not a claim of standing under it. Where a platform is required to hold a registration, that registration is held by the platform or by its client, is stated on that platform’s own surface, and is verifiable at the relevant regulator.