Software Recoverability by Industry | Castler

BANKING & NBFCS

Every core banking system, payment rail and risk engine your bank runs — Castler makes it recoverable.

Customers and institutions: HDFC Bank · SBI · Canara Bank · Central Bank of India · Indian Bank

The vendor risk

Banks and NBFCs depend on core banking platforms, lending origination and management systems, payment switches, KYC and AML engines, treasury software, reconciliation tools, customer channels and regulatory-reporting systems. A provider failure can interrupt account access, settlement, credit decisions or statutory reporting. The recovery clock is measured against customer impact, payment obligations and board-approved continuity objectives — not the time it takes a vendor to respond.

The regulatory requirement

RBI IT Directions §12(f) requires source-code access or software escrow for critical applications and includes updates and programme fixes. RBI PSO §17(c) applies tiered escrow requirements to non-bank payment operators. Banks also need tested continuity and credible exit for material service providers.

How Castler works

Castler activates Cloud Custody during vendor onboarding, captures every release and maps the critical application Software Estate. Software Recoverability then rebuilds and deploys each release, producing a signed Proof of Recovery for the bank’s current version rather than a historic deposit.

RBI IT §12(f) RBI PSO §17(c)

INSURANCE

Policy, claims and actuarial systems must remain recoverable when the software provider is not.

Customers and institutions: Star Health

Explore sector

The vendor risk

Insurers rely on policy-administration platforms, claims engines, underwriting workbenches, actuarial models, broker portals, document systems, payment interfaces and fraud controls. The most damaging failure is rarely a single application screen: it is the inability to issue policies, settle claims, calculate reserves or serve customers while recovery knowledge remains with an unavailable vendor.

The regulatory requirement

IRDAI Information and Cyber Security Guidelines 2023 place software escrow, source-code availability, cyber governance, outsourcing risk and business continuity within the insurer’s control environment. Critical applications need more than contract language; the insurer needs current materials and a recovery procedure it can examine.

How Castler works

Cloud Custody maintains the policy or claims platform deposit and full release history. Castler Software Recoverability independently rebuilds, deploys and verifies the application, records exceptions, and provides a named engineer’s seal that can be presented to the risk committee, auditor or regulator.

IRDAI CS Guidelines ISO 22301

CAPITAL MARKETS

Market infrastructure cannot wait for a software vendor to recover itself.

Customers and institutions: NSDL · HDFC Securities · JM Financial

Explore sector

The vendor risk

Exchanges, depositories, clearing corporations, brokers, RTAs and investment firms depend on trading, clearing, settlement, surveillance, risk, margin, custody, client-onboarding and reporting platforms. A delayed recovery can affect market access, investor records, settlement finality and regulatory reporting. These systems often combine specialist software, custom integrations and operational knowledge held by a small vendor team.

The regulatory requirement

SEBI CSCRF requires cyber-resilience governance, third-party risk controls, continuity and testing across market infrastructure institutions and regulated entities. Critical vendor applications require current escrow and evidence that the institution can sustain the supported function through disruption.

How Castler works

Castler maps the application, repository and operating architecture at onboarding. Each release is captured, rebuilt and tested. The Proof of Recovery pack combines build evidence, SBOM, deployment runbook, replication report and engineer seal so the institution can show a procedure, not an assumption.

SEBI CSCRF SOC 2 availability

PAYMENTS & FINTECH

Payment continuity depends on every switch, ledger, KYC service and reconciliation engine in the stack.

Customers and institutions: Pine Labs · India Post Payments Bank · NSDL Payments Bank

Explore sector

The vendor risk

Payment System Operators and fintechs operate dense third-party stacks: payment switches, acquiring gateways, ledgers, fraud controls, KYC services, mandate engines, settlement systems, reconciliation tools and sponsor-bank integrations. A vendor outage can strand transactions, delay settlement, affect merchant funds and create immediate reporting obligations. The dependency begins when the vendor is onboarded.

The regulatory requirement

RBI’s PSO cyber-resilience framework applies tiered implementation dates and requires non-bank PSOs to obtain source code or establish escrow for critical software. The broader technology-risk expectation is that payment continuity remains under the operator’s control even when a provider fails.

How Castler works

Castler starts with the tripartite agreement and current deposit, then adds automated build and deployment evidence for the systems inside the payment perimeter. Software Estate-level coverage matters because continuity can fail at any vendor in the transaction path, not only the primary switch.

RBI PSO §17(c) RBI IT §12(f)

ENTERPRISE & SAAS VENDORS

Turn recoverability from a procurement objection into a signed enterprise trust signal.

Customers and institutions: Enterprise software vendors serving regulated buyers

Explore sector

The vendor risk

ISVs and SaaS companies increasingly face customer requirements for source-code escrow, continuity, step-in support, SBOMs and evidence that the application can be operated if the vendor is acquired, discontinues a product or loses key engineers. Managing separate manual escrow obligations for every enterprise customer creates administrative work and inconsistent deposits.

The regulatory requirement

The vendor may not be directly regulated, but its customers are. DORA, RBI, SEBI, IRDAI, FCA, MAS and APRA obligations flow into contracts, procurement questionnaires and assurance reviews. The vendor must provide a credible custody and recovery model without exposing source code to every beneficiary.

How Castler works

Castler provides one controlled custody platform for multiple beneficiary agreements, automatic release capture and reusable verification evidence. The vendor participates in onboarding and reconciliation once; subsequent verification can run independently, reducing repetitive customer assurance work.

EU DORA UK SS2/21

GLOBAL FINANCIAL INSTITUTIONS

One recoverability evidence base for DORA, FCA, MAS, APRA and local supervisory expectations.

Customers and institutions: Financial institutions operating across India, Europe, the UK, Singapore and Australia

Explore sector

The vendor risk

Global institutions manage critical software across multiple legal entities, clouds, data-residency boundaries and supervisory regimes. The same vendor may support important business services in several markets, while contracts, deposits and testing evidence sit in separate teams. Provider failure exposes concentration risk, inconsistent exit planning and uncertainty about which release can actually be recovered in each region.

The regulatory requirement

DORA requires ICT third-party risk management and credible exit controls. UK supervisors expect stressed-exit and impact-tolerance evidence. MAS technology-risk guidance and APRA CPS 230 require tested continuity and material-service-provider governance. Local custody and source-code rules may apply in parallel.

How Castler works

Castler creates a common Software Estate inventory, region-aware custody, release-level verification and one Proof of Recovery format that can be mapped to each applicable rulebook. Evidence remains linked to the vendor, release, architecture and engineer seal while the regulatory interpretation is presented by jurisdiction.

EU DORA MAS TRM APRA CPS 230

Every regulated industry runs on vendor software. Castler makes the critical Software Estate recoverable

The rulebook changes. The recovery standard does not

Banking & NBFCs

Insurance

Capital Markets

Payments & Fintech

Telecom

Energy & Utilities

Healthcare & Life Sciences

Government & Public Sector

Manufacturing

Defence & Aerospace

Enterprise Software

Global Financial Institutions

Every core banking system, payment rail and risk engine your bank runs — Castler makes it recoverable.

The vendor risk

The regulatory requirement

How Castler works

Policy, claims and actuarial systems must remain recoverable when the software provider is not.

The vendor risk

The regulatory requirement

How Castler works

Market infrastructure cannot wait for a software vendor to recover itself.

The vendor risk

The regulatory requirement

How Castler works

Payment continuity depends on every switch, ledger, KYC service and reconciliation engine in the stack.

The vendor risk

The regulatory requirement

How Castler works

Turn recoverability from a procurement objection into a signed enterprise trust signal.

The vendor risk

The regulatory requirement

How Castler works

One recoverability evidence base for DORA, FCA, MAS, APRA and local supervisory expectations.

The vendor risk

The regulatory requirement

How Castler works

Onboard

Verify

Prove

Built for your sector’s Software Estate