Frequently askedquestions

Identity verification confirms that the candidate is who they claim to be. In India, this means: (1) Aadhaar OTP e-KYC — confirms the Aadhaar number is active, linked to the registered mobile, and the demographic data matches UIDAI records; (2) Liveness selfie match — real-time face match against the Aadhaar-linked photo to prevent impersonation; (3) PAN verification — confirms the PAN number is linked to the correct name and date of birth in the Income Tax database. These three checks together eliminate the most common identity fraud vectors.

Employment verification confirms the accuracy of the candidate's declared work history. Checks include: dates of joining and leaving (against HR records or payroll), job title or designation held, reason for leaving (when available from HR), and whether the candidate is rehire-eligible. For stronger verification, EPF/ESIC contribution records are cross-referenced — these are objective government records that cannot be fabricated, making them a higher-confidence source than manager references alone.

Education verification confirms that degrees, diplomas, and certifications claimed by the candidate were actually awarded by the stated institution. This includes verifying: the institution's UGC/regulatory recognition, the candidate's registration or enrollment number, the degree name and year of passing, and whether the certificate matches the institution's records. Premium verification uses DigiLocker API or direct university API integration for a cryptographically signed result. This is essential given that counterfeit degree certificates are available for as little as ₹500–₹2,000 in several Indian cities.

A criminal background check in India searches district court records across the candidate's declared states of residence and employment. It may include: FIR records (where accessible), chargesheet and trial records, civil court records (relevant for fraud/dispute patterns), and database checks against sex offender registries, terrorism watchlists, and regulatory enforcement databases. Coverage varies by jurisdiction — not all Indian courts have digitised records, which is why multi-jurisdiction manual searches are recommended for high-trust roles.

Address verification confirms that the candidate actually resides at the address they have declared. Digital verification cross-references the declared address against Aadhaar records and utility bills. Physical verification involves a field agent visiting the address, confirming residency through the candidate or a family member, and photographing the property. Address verification is particularly important for roles involving trust (domestic workers, finance, healthcare) and for driver verification, where a verifiable permanent address is a key fraud prevention control.

Driver licence verification confirms the validity and details of a candidate's driving licence via the Ministry of Road Transport's Sarathi database. It checks: whether the DL number exists in the national database, the name and date of birth match, the licence is not expired or suspended, and the authorised vehicle classes match the role (LMV, HMV, Transport, etc.). It can also include an eChallan check for unpaid traffic fines and a Commercial Vehicle Badge check for PSV endorsement. This verification is essential for logistics, ride-hailing, and delivery platforms.

Compliance screening checks a candidate or vendor against regulatory watchlists, sanctions lists, and adverse media sources. This includes: SEBI enforcement orders, ED/CBI watchlists, OFAC sanctions (relevant for multinational companies), UN Security Council designations, PEP (Politically Exposed Persons) screening, and global adverse media search. Compliance screening is mandatory for BFSI roles, senior executive hires, and any entity onboarding that falls under PMLA obligations.

Vendor due diligence (also called KYB — Know Your Business) verifies companies rather than individuals. It checks: MCA company registration status and CIN verification, GST registration and compliance, director identity and DIN verification, litigation and insolvency searches (NCLT/NCLAT), UBO (Ultimate Beneficial Owner) screening against PEP and sanctions lists, and financial health indicators. Unlike employee BGV, vendor due diligence assesses a legal entity — its registration, its owners, its legal standing, and its compliance history — not a single person.

A reference check involves contacting former managers, colleagues, or other professional contacts named by the candidate to gather qualitative feedback about their performance, work style, and reliability. Reference checks are typically separate from and supplementary to standard background verification — they provide context that database checks cannot, but they are inherently subjective and can be gamed by candidates who provide cooperative references. Most Truvixx packages include employment verification (objective) rather than reference calls (subjective), though reference check services are available as an add-on.

Yes. Background verification is legal in India when conducted with the candidate's informed consent, for a legitimate employment purpose, and in compliance with the Digital Personal Data Protection (DPDP) Act 2023 and applicable labour laws. Employers have a recognised legal basis for processing candidate personal data for employment screening purposes. However, the DPDP Act now requires this processing to be based on documented, purpose-specific consent — not buried in a general employment contract clause.

Under DPDP Act 2023 Section 6, consent for BGV must be: Free (not coerced), Specific (describing which checks will be run and what data will be collected), Informed (including who will process the data, which databases will be queried, and how long data will be retained), Unconditional (no bundled consent with other terms), and Unambiguous (an affirmative opt-in — not a pre-ticked box or implied consent from signing an employment contract). A standalone digital consent form — separate from the offer letter — is the correct implementation. Truvixx's candidate portal handles this automatically.

Under the DPDP Act, the employer is the Data Fiduciary — the entity that determines why and how personal data is processed — and bears primary legal responsibility for obtaining valid consent, defining the purpose of processing, and responding to Data Principal rights requests. The background verification platform (Truvixx) is the Data Processor — it processes data on the employer's behalf under a Data Processing Agreement. Both parties have obligations, but the employer cannot outsource the accountability for consent to the BGV vendor.

Yes. Under the DPDP Act, a candidate has the right to withhold or withdraw consent. An employer can make employment conditional on satisfactory background verification for roles where checks are a reasonable necessity — and a candidate who refuses may not proceed in the hiring process. However, an employer should not attempt to coerce consent for checks that are not proportionate to the role's requirements. A candidate's refusal to consent to a criminal check for a security-sensitive finance role is a legitimate hiring decision factor; refusal to consent to an irrelevant check category is a different matter.

The DPDP Act requires data retention for no longer than necessary for the stated purpose. Industry guidance generally suggests: for candidates who did not join — delete or anonymise within 6 months of the final hiring decision; for employees who did join — retain for the duration of employment plus a defined post-employment period (typically 2–7 years, depending on legal hold requirements); for background reports used in regulated industries — follow the sector-specific retention guidance from SEBI, RBI, or relevant regulator. Truvixx's platform enforces automated retention schedules and deletion on expiry.

The DPDP Act 2023 provides for a tiered penalty structure enforced by the Data Protection Board of India. The maximum penalty for significant violations — such as failure to obtain valid consent, breach of data minimisation requirements, or failure to implement adequate security measures — can reach ₹250 crore (approximately USD 30 million). Lesser violations attract penalties up to ₹50 crore. The Board is being constituted and enforcement is being phased in, but companies should treat the current period as the window to achieve compliance before active enforcement begins.

Yes. A Data Processing Agreement is included with every Truvixx plan. The DPA documents: the nature and purpose of processing, the categories of personal data processed, the security measures in place, sub-processor details, data subject rights handling procedures, data retention and deletion obligations, and the allocation of DPDP Act responsibilities between Truvixx (as Data Processor) and the client (as Data Fiduciary). Enterprise clients can request custom DPA terms.

Check selection should be proportionate to the role's risk profile. General guidance: For all roles — identity verification and criminal records check. For roles with financial responsibility — add employment verification, education verification, and compliance/adverse media screening. For roles with vehicle operation — add driver licence and eChallan verification. For roles with access to homes or sensitive locations — add physical address verification. For senior leadership and C-suite — add full employment history, education, compliance screening, and a director/litigation search. For vendor onboarding — full vendor due diligence including UBO verification and MCA/NCLT search.

Best practice is to issue a conditional offer letter after the candidate clears final interviews, with employment made contingent on satisfactory background verification. Running checks before any offer risks losing candidates to competitors during the verification window, and may raise DPDP Act consent concerns if data is processed before a legitimate employment relationship is established. The conditional offer model is the industry standard in India — it balances speed with verification rigour.

Follow your documented adjudication policy (which you should have in place before you start running checks). The standard process: (1) Classify the discrepancy as critical, major, or minor based on your policy; (2) For anything above minor — give the candidate a chance to respond with supporting documentation; (3) Assess the response against your policy; (4) Make a decision and document your reasoning. Never reject a candidate without giving them an opportunity to explain a discrepancy, and always document the rationale for any adverse decision — both for legal protection and DPDP Act compliance.

Yes, with appropriate consent and a documented purpose. Common scenarios for re-verification of current employees include: periodic re-screening for roles with high-trust access (annual for finance, security, or data-sensitive roles); promotion to a new role category that carries greater responsibility; post-acquisition integration (verifying inherited employees); and regulatory compliance requirements in BFSI and healthcare. Existing employees must consent to re-verification just as new hires do — implied ongoing consent is not valid under the DPDP Act.

For previous employers that have shut down or been acquired: (1) Check EPF/ESIC contribution records — these are maintained by the government and show contributions made during actual employment, regardless of the company's current status; (2) Look for the company in MCA records — even dissolved companies have a record history showing when they were active; (3) Ask the candidate for payslips, Form 16, or offer/experience letters from the period; (4) Contact former colleagues who may be traceable via LinkedIn. EPF records are the most reliable fallback when direct employer verification is impossible.

A realistic timeline for standard pre-employment BGV: identity and PAN verification — same day (API-based); employment verification — 1–3 business days (depends on HR responsiveness at previous employers); education verification — 1–5 business days (varies by institution record-keeping); criminal database search — same day; physical address visit — 1–3 business days; court record manual search — 3–7 business days. A typical full-package BGV completes in 5–7 business days. For roles with urgency, identity and criminal checks can be fast-tracked as a conditional pre-hire screen with remaining checks running in parallel.

No centralised national blacklist exists in India for background check failures. Individual platforms and industry associations maintain internal do-not-hire records, and some sector-specific bodies (like certain BFSI trade associations) share adverse records among members. From a DPDP Act perspective, creating or sharing a 'blacklist' of candidates based on background check outcomes requires careful legal review — there are data protection, defamation, and discrimination considerations depending on the nature of the listed information.

For high-volume hiring, the key design principles are: (1) Standardise check packages by role category — don't decide per candidate; (2) Automate consent collection through your candidate portal or ATS integration; (3) Use bulk upload or API batch processing rather than submitting candidates one at a time; (4) Set activation gates — define which checks must pass before Day 1 access is granted; (5) Implement webhook notifications so results trigger automatic HR workflow updates; (6) Define and document your adjudication policy before you start, so discrepancy decisions are consistent and defensible at volume.

The data collected depends on which checks are included. Common data collected: full name, date of birth, Aadhaar number (for e-KYC), PAN number, current and permanent address, employment history (company names, dates, designations), educational qualifications (institution name, degree, year, registration number), and a liveness selfie for identity matching. For driver checks: driving licence number and vehicle details. No data beyond what is necessary for the specific checks should be collected — this is a requirement under the DPDP Act's data minimisation principle.

Not without your knowledge and consent. Most background verification processes only verify past employment history. A few employers request verification of current employment, but this must be clearly disclosed in the consent form before the check begins. If you are concerned about your current employer being contacted, check the consent form carefully before submitting. Standard practice is to exclude current employers from employment verification unless the candidate explicitly includes them.

Under the DPDP Act 2023, you have the right to access personal data that has been collected about you. This includes the ability to request a copy of your verification report from either the employer (as Data Fiduciary) or the BGV platform (as Data Processor). In practice, many employers share the report with the candidate as part of the pre-adverse action process when a discrepancy is found. You can submit a data access request to Truvixx at privacy@truvixx.com.

If you believe a verification result is incorrect: (1) Contact the employer's HR team and request details of the specific discrepancy; (2) Gather supporting documentation — original certificates, offer letters, payslips, EPF passbook — that contradicts the finding; (3) Submit the documentation with a written explanation; (4) If the dispute concerns a government database record (e.g., a wrong criminal record entry or an Aadhaar data mismatch), the correction process runs through the relevant authority (UIDAI for Aadhaar, court records through an advocate for criminal record corrections). Under the DPDP Act, you also have the right to request correction of inaccurate personal data held by Truvixx — email disputes@truvixx.com.

If you did not join the company: your verification data should be deleted within 6 months of the final hiring decision, or earlier on your request. If you joined: data is typically retained for the duration of your employment plus a post-employment period (commonly 2–7 years, depending on the company's legal hold requirements). Under the DPDP Act, you have the right to request erasure of your personal data at any time — the company must respond within a reasonable timeframe unless there is a legitimate legal ground for retention.

No. Employment background verification in India does not involve a credit bureau inquiry and does not affect your CIBIL or credit score. The checks conducted — identity, employment, education, criminal, address — do not touch your credit file. Only lender-initiated credit checks (for loans, credit cards) appear on your credit bureau report and affect your score.

Three differences define the Truvixx approach: (1) Speed — API-first architecture means identity, PAN, and DL checks complete in minutes, not days. Most primary checks return under 24 hours. (2) Compliance-by-design — DPDP Act consent flows, retention schedules, and a DPA are built into every plan, not sold as add-ons. (3) Transparency — every report includes source attribution (which database returned which result) and discrepancy classification (critical / major / minor), so your team can make informed decisions rather than just seeing a pass/fail verdict.

Truvixx serves companies across logistics and transport (driver and fleet verification), BFSI (employee and vendor screening), IT and tech (pre-employment and contractor verification), gig and platform economy (driver, delivery, and service partner onboarding), healthcare (professional credential verification), staffing agencies (placement cohort verification), and enterprise HR across all sectors. We have purpose-built check packages for each vertical rather than one-size-fits-all bundles.

All candidate data is encrypted at rest with AES-256 and in transit with TLS 1.3. Data is stored exclusively in India (AWS Mumbai region) — it never leaves Indian soil without explicit consent. We conduct annual third-party penetration testing, enforce MFA for all platform users, and maintain tamper-proof audit logs of every data access event. Full security documentation is available to Enterprise clients on request.

Yes. Truvixx provides a full REST API with an OpenAPI specification, HMAC-signed webhooks, idempotency keys, and a sandbox environment for integration testing. Our batch API supports up to 500 candidates per request with parallel processing. Webhooks fire on candidate status changes so your ATS or HRMS can update automatically without polling. Growth and Enterprise plan users have API access included; SDK support for Node.js and Python is in development.

Yes. All plans include a 14-day free trial with 5 complimentary verifications — no credit card required. The trial includes full platform access: dashboard, candidate portal, PDF reports, and API access. You can run real checks with actual candidate data during the trial period. To start your trial, visit the Contact page or email info@truvixx.com.

Starter plan: email support with a response within one business day. Growth plan: priority email and chat support with a 4-hour response target during business hours. Enterprise plan: dedicated account manager, 24/7 critical issue support, and a contractual SLA. All plans include access to our documentation, integration guides, and onboarding support.

Three ways to start: (1) Sign up for a free trial directly from the pricing page — you'll have your first check running within 15 minutes; (2) Book a 30-minute demo via the Contact page — we'll walk through your specific use case, check requirements, and integration options; (3) Email info@truvixx.com with your requirements and we'll set up a call. For Enterprise and bulk verification requirements, a discovery call is recommended before setup.