Why it matters hereKolkata has been a trading centre for more than three centuries. The old firms of the Dalhousie quarter and Park Street still deal in tea, jute, metals and shipping. Across the river and to the east, Salt Lake Sector V and New Town in Rajarhat host the city's tech firms. Capability centres, IT service houses and young product teams share those blocks.
Financial services are the city's distinctive strength. Many banks, NBFCs and microfinance lenders that serve the east and north-east run from here. A cluster of Sector V firms develops lending, collection and core banking systems for them. Healthcare is the other pillar. Patients travel to Kolkata's hospitals from across the region and from nearby countries.
These firms now hold contracts well beyond Bengal. A Sector V team runs apps for a US retailer. A New Town analytics unit processes claims data for a European insurer. A Salt Lake health-tech firm stores records for patients from Dhaka and Thimphu. Before work begins, the client's security team requests evidence of control.
In the US, that evidence is the SOC 2 report. It is signed by a licensed CPA practice that has tested a Sector V firm's safeguards against AICPA criteria. Clients review it once and proceed. Without it, they issue long questionnaires and delay the contract.
SOC 2 certification in Kolkata has therefore become a standard requirement. It supports overseas sales. It also assists Indian lenders, who must assess every technology vendor they rely on.
The regulatory environment is demanding. Under the DPDP Act 2023, any firm that handles personal data must protect it and report breaches promptly. CERT-In wants listed incidents reported in six hours and logs kept for 180 days. Loan tech firms face RBI rules through their lender clients. Brokers' vendors face SEBI. Insurers' vendors face IRDAI. One documented SOC 2 control set can support each of them. A clear plan for SOC 2 certification turns a long list of requirements into a sequence of owned, dated tasks.
