Background verification, explained.

This page is the standard operating procedure, policy and terms of use for the background verification ("BGV") services of Gradiify, a product of Gradii, operated by Manjari Technologies Private Limited ("Gradii", "we", "us").

By initiating, completing or relying on a background verification, the requesting employer (the "Client") and the candidate being verified (the "Candidate") agree to these terms. They apply together with our Terms of Service and Privacy Policy.

The Client chooses which checks to run for each candidate. Turnaround times are typical, counted from when the candidate completes their part.

The BGV Complete package runs every check above for one price per candidate. Identity verification with a selfie and face match is available where the Client enables it. Current prices are on our pricing page.

Every verification rests on the candidate's explicit, informed and specific consent. Before anything is checked, the candidate sees what will be checked, by whom and why, and agrees. The consent is recorded with a timestamp.

Documents are fetched through DigiLocker, the Government of India service run by the Ministry of Electronics and Information Technology, using its authorised APIs through API Setu. The candidate signs in to DigiLocker and chooses which documents to share. No document is accessed without the candidate's action.

Consent type

Electronic consent through DigiLocker's OAuth 2.0 flow, valid under the Information Technology Act, 2000

Purpose

Employment-related background verification only. It cannot be used for any other purpose

Scope

Document-specific: only the documents the candidate approves

Validity

30 days from initiation, or until the date in the consent record, whichever is earlier

Withdrawal

Before the final report, by writing to team@gradii.ai. Withdrawal stops further processing; it does not undo checks already completed or refund charges already incurred

The process is designed to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

Gradii does not create or add to data. A report presents only what these sources return:

• DigiLocker, through API Setu: identity documents and education certificates, fetched directly from the government and institutional issuers
• Verification APIs: PAN and bank-account details through Cashfree; document authenticity, face match, sanctions, PEP and adverse-media screening through our identity verification provider
• Former employers: past-employment details the candidate provides are sent to the former employer's HR, and the check is marked complete only after their written or electronic confirmation
• Device signals: the IP address used to complete the verification, checked for location and fraud signals

Results depend on the availability, accuracy and response times of these sources. Gradii does not guarantee outcomes from sources outside its control, and is not responsible for delays caused by institutions or employers that don't respond.

1. 1Initiation. The Client starts a request on Gradii and chooses the checks. The candidate receives a secure, time-limited link by email. Charges apply from this point (section 11).
2. 2Consent and documents. The candidate opens the link, reviews the request, signs in to DigiLocker and approves the documents to share.
3. 3Other details. Where those checks are selected, the candidate provides bank-account details, past-employment details and, if enabled, a selfie for face matching.
4. 4Checks run. Gradii retrieves the approved documents over encrypted connections, runs the verification APIs and screening, and sends employment-verification forms to former employers.
5. 5Employment follow-up. If a former employer does not respond within 7 working days, the check is marked "Pending: employer non-responsive" in the report. Gradii is not liable for delays caused by third-party employers.
6. 6Report. When the checks are complete, or have timed out, the report is available to the Client in the dashboard, through the API or by webhook. It is read-only and access-controlled, and can be downloaded as a PDF.
7. 7Incomplete requests. If the candidate does not complete DigiLocker sign-in before the link expires, the request is marked "Candidate non-responsive". The charge still applies, and the Client may start a new request, which is charged again.

AML screening checks the candidate against global sanctions, politically exposed person (PEP) and watchlist databases, and adverse media, using our identity verification provider. It uses two separate scores, so that a name match is not treated as a risk until it is likely to be the same person.

How the outcome is reached

1. 1The candidate's details are screened against the watchlists and media sources.
2. 2Each potential match gets a match score. Matches below the threshold are false positives and are set aside.
3. 3Each remaining match gets a risk score.
4. 4The highest risk score sets the result: Approved, In review or Declined. If every match is a false positive, the result is Approved.

What is screened

• Sanctions lists, including OFAC, EU and UN lists, with the list name, authority, programme, legal basis, listing date and source for each match
• Politically exposed persons at four levels, from heads of state to relatives and close associates
• Regulatory warnings and enforcement, fitness and probity registers, and insolvency registers
• Criminal records where sources are available, and adverse media covering financial crime, fraud, violent crime, terrorism, narcotics and regulatory breaches

Under the Digital Personal Data Protection Act, 2023, a candidate whose data is processed for a background check can:

• Access: ask for a summary of the personal data processed, and what it was used for
• Correct or erase: ask for inaccurate or incomplete data to be corrected, or for data no longer needed to be erased, subject to legal retention duties
• Withdraw consent: before the final report. Processing already done remains lawful; after withdrawal we stop further processing and delete data not subject to a legal hold within 30 days
• Raise a grievance: with our Grievance Officer (section 12)
• Nominate: someone to exercise these rights in the event of death or incapacity

The Client is the Data Fiduciary for the candidate's data. Requests that reach Gradii are passed to the Client and answered with its help. Some rights may be limited where the law, a court order or a legal claim requires data to be kept.

Retention

• Background verification reports and documents: 6 months after the report is complete, by default. The Client can set a different period by contract.
• DigiLocker and identity-verification audit logs: 3 years, as evidence of consent and lawful fetching.
• Automatic deletion at the end of the default period is still being built. Until it ships, we delete on request and in a quarterly review.
• Clients may need to keep reports longer for their own legal reasons. They can download reports, and are responsible for keeping them no longer than the law allows.

Security

• Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), and stored in India.
• Documents sit in private storage, reached only through short-lived signed links. Every DigiLocker request is audit-logged.
• Access is limited to the requesting Client's authorised users and to Gradii personnel who need it.
• If a personal-data breach occurs, we notify the Client without undue delay so it can meet its own duties, and inform the Data Protection Board of India as the DPDP Act requires.

Transfers outside India

Data is stored in India. Our identity verification provider, which performs document authenticity, face match and AML screening, and the IP geolocation service process data in the European Union while handling a request. All sub-processors and their locations are listed in our Privacy Policy.

By initiating a background verification, the Client agrees to:

• Use the report solely to evaluate the candidate for employment or engagement with the Client
• Not share, sell, publish or disclose the report to anyone else, including group companies, without a separate data-sharing agreement and the candidate's consent
• Comply with employment, anti-discrimination and data protection laws when using the report
• Store the report securely, restrict access to people who need it, and delete it when its lawful retention period ends, or when Gradii asks

Before taking adverse action

If the Client intends to reject, dismiss or demote a candidate based wholly or partly on the report, it is strongly advised, and in some jurisdictions required, to:

1. 1Tell the candidate in writing that adverse action is being considered, before deciding
2. 2Give the candidate a copy of the relevant parts of the report
3. 3Allow at least 5 working days for the candidate to respond or dispute the findings
4. 4Consider the candidate's response in good faith before deciding

Gradii is not a party to employment decisions and is not liable for adverse action taken by a Client.

Indemnity

The Client will indemnify and hold harmless Gradii and Manjari Technologies Private Limited, and their officers, directors, employees and agents, against claims, losses and costs (including reasonable legal fees) arising from: (a) misuse of a report; (b) breach of these terms; (c) any employment decision based on a report; or (d) breach of the Client's data protection obligations.

Reports are private and confidential, for the requesting Client's legitimate employment and compliance purposes only. They are proprietary output of Gradii.

Unauthorised access, sharing, reproduction or transmission of a report, in whole or in part, is prohibited and may lead to civil and criminal liability under the Information Technology Act, 2000 and other applicable laws. The Client must not use a report to harass, defame or discriminate against a candidate.

Gradii takes commercially reasonable steps to make reports accurate, but they depend on external sources, third-party responses and candidate-supplied information. Gradii and Manjari Technologies Private Limited make no warranty, express or implied, as to their absolute accuracy, completeness or fitness for a particular purpose.

To the fullest extent the law allows, Gradii is not liable for:

• Employment, financial, contractual or legal decisions taken on the basis of a report
• Errors or omissions in data from third-party providers, government databases or institutions
• Delays caused by employers, institutions or data sources that don't respond
• Indirect, incidental, special or consequential losses, including lost profit, revenue or business
• Anything the Client does in reliance on a report

Prices are on our pricing page, or as agreed with the Client. Charges are deducted from the Client's Gradii wallet. The following rules apply:

• Check-based billing: billing is based on the checks selected when a request is initiated and submitted for processing. Every check selected in that request is billable, whether or not the candidate completes every step.
• When charges apply: at the point the Client initiates and submits the request.
• Incomplete requests: charges remain payable if the request is later incomplete, expired, cancelled at the Client's request or abandoned, including where the candidate never opens the link or never completes DigiLocker sign-in, and whatever the result or hiring outcome, except where the failure is solely due to a material technical error by Gradii.
• Reminders: re-sending reminders on the same request is not a new billable request.
• Extensions and resumption: extending a request's expiry, or letting a candidate resume it, is billable at the applicable rates.
• Re-initiation: a re-initiated request that creates a new verification request is billed again for every check selected in it.
• Gradii errors: a request duplicated or re-initiated solely because of a Gradii system error is not billed again.
• Refunds: fees are non-refundable once a request has been initiated, except in the two cases of Gradii error above.
• Disputes: billing disputes must be raised in writing to team@gradii.ai within 15 days of the charge.

The fee covers processing, verification APIs, secure data handling and compliance. These billing terms form part of the agreement between the Client and Manjari Technologies Private Limited.

Under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, Gradii has a Grievance Officer for complaints from candidates, Clients and others.

Grievance Officer

Himanshu P Bohra

Organisation

Manjari Technologies Private Limited (operating as Gradii)

Email

team@gradii.ai

Post

316, Neelkanth Corporate Park, Vidyavihar West, Mumbai, Maharashtra, India

Response time

Acknowledged within 3 business days; resolved within 30 days of a complete grievance

Escalation

If unresolved, to the Data Protection Board of India once its complaints process is open, or to the courts in section 13

• These terms and the BGV services are governed by the laws of India.
• Disputes are subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.
• As an alternative, either party may refer a dispute to arbitration under the Arbitration and Conciliation Act, 1996, seated in Mumbai and conducted in English. The award is final and binding.
• Before starting legal proceedings, a party must first use the grievance process in section 12. Proceedings may start only if the grievance is not resolved within 45 days.