Dhruv Shahi

Cybersecurity and GRC engineer who builds the AI he governs.

Four years securing regulated systems, now building the software that does the governing. Every product below is one you can open.

ISO 27001:2022 Lead Auditor · PCI DSS v4.0 Lead ImplementerBengaluru and Delhi NCR · Remote · US hoursGITHUB ↗LINKEDIN ↗EMAIL

Selected work

01 · GOVERNANCE

ZeroFinding

An AI-native GRC platform. On top, a practitioner reference across twelve frameworks. Underneath, an engine that grades an AI system against ISO 42001, NIST AI RMF and India DPDP. Governance reviews are usually prose, so two readers get two answers. This one reproduces: same input, same verdict, every run. It also reports its 73 worked controls and 53 skeleton entries separately, because a skeleton is a heading with nothing behind it.

TypeScript · Next.js portal · dependency-free engineBuilt · not yet deployed

ZeroFinding's compliance framework reference: twelve frameworks including ISO 27001, SOC 2, NIST CSF, PCI DSS, HIPAA and GDPR, each with its issuing body and version. — The portal, run from its own code, captured 2026-08-07

govern · corpus check + golden run

$ node scripts/validate.mjs
dpdp: 16 controls (16 worked, 0 skeleton), 28 AOs, 5 flagged needs_verification, 2 applicability rules + 2 role rules
iso42001: 38 controls (38 worked, 0 skeleton), 53 AOs, 4 flagged needs_verification, 2 applicability rules + 0 role rules
nist-ai-rmf: 72 controls (19 worked, 53 skeleton), 20 AOs, 3 flagged needs_verification, 2 applicability rules + 0 role rules

corpus integrity: OK

$ npx tsx core/eval/run.ts
golden cases: 52/52 passed

The engine underneath it. Real output, captured 2026-08-07

02 · MARKETPLACE

ArtistNextDoor

A live marketplace where event organisers book performing artists: singers, DJs, dancers, magicians, comedians. Artists build profiles and get paid, with real payment, refund and policy flows behind the bookings. I shipped work across its frontend and backend.

Live

artistnextdoor.in ↗

03 · PRODUCT

PawVeda

A pet wellness app for India, built with a co-founder. A rules engine scores symptoms on the device first, then the model adds context. The local verdict is computed before the model runs and travels with the response, so the app can always say what it decided without the model. Anything not real is labelled on the screen.

React and Vite on the web · Expo for the appWeb app live · Android app in internal testing on Play

pawveda.vercel.app ↗

PawVeda running on an Android device: a wellness score for Bruno, a two minute symptom check, the next care action, quick actions for weight and medication, and a Bengaluru monsoon note. A DEMO DATA chip labels the sample content. — The shipped Android app on a device, captured 2026-08-07

04 · PUBLIC DATA

Pravaha

Pravaha means flow, and it reads two: the water India pumps and the air it breathes. Groundwater from CGWB records, air from Central Pollution Control Board stations. Every figure carries its source and its age, and when a feed cannot be verified the layer refuses to draw rather than show you a number that looks current. Carbon accounting sits alongside, sourced line by line. Turning that accounting into credits is a direction I am researching, not something built.

Static site · plain JavaScript over public dataLive

pravaha.dhruvshahi.com ↗

Pravaha's live air layer: per-city AQI with PM2.5 and PM10 for Agra, Ahmedabad, Bengaluru, Chennai, Delhi and Faridabad, each naming its Central Pollution Control Board monitoring station, above a banner stating the last fetch is older than the scheduled cadence. — The built site, showing the age of its own data, captured 2026-08-07

Also built

A refusal rule for client dataThe agent I use for consulting work carries one rule that overrides every instruction I give it. If a prompt contains a real client identifier it stops, tells me the project is firewalled and offers a synthetic company instead. It does not repeat the identifier back to me.GRC
A board that will not let a writer grade itselfOne agent writes the assessment and three read it back. An evidence checker re-derives every verdict from the source answers, a consistency reviewer hunts contradictions across the whole set at once, and a third fans out one sub-agent per domain. The agent that wrote the work never passes it.AGENTS
Labels for anything that is not realPawVeda carries a chip with eight states, from mocked to scripted to local only, used across thirty two files to say what a surface actually is. Every generated image is logged with the prompt that made it, the model, the date and where it is used, so nothing on screen can quietly pass for real.APPLIED AI
My own skill libraryFourteen skills I wrote for my own work, from capturing a raw idea to gating scope creep before it lands. Four of them keep a learning folder: they log every run and adjust the next one.APPLIED AI
The idea wallEvery idea I capture gets a brief attached: the market, the buyer, the competitors with their pricing and their gap, an MVP scope and a fourteen day plan. Two skills feed it, one from a link or a passing thought, one from a folder of screenshots.APPLIED AI

Approach

Every line here is proved by something above it on this page.

Compliance as running code.

Taking a framework that exists as prose and turning it into something that executes, so the same review returns the same verdict twice.

Above: ZeroFinding, graded against ISO 42001, NIST AI RMF and India DPDP.

AI features that stay accountable.

Model features for products where someone will eventually ask what decided this, and the product has to be able to answer.

Above: PawVeda decides on the device before the model runs.

Numbers that carry their source.

Data work where every figure states where it came from and how old it is, and refuses to draw at all when the feed cannot be verified.

Above: Pravaha, showing the age of its own last fetch.

Shipped, not demoed.

Production systems with payments, refunds and policy flows, used by people who are not me.

Above: ArtistNextDoor, live.

About

I came up through cyber consulting and moved toward the code. Now I build the instruments that regulated work usually does by hand.

NOWSenior engineer, US compliance platformsBuilding and evaluating systems where the rules are the product.

BEFORECyber consulting, EYPromoted in 14 months. Roughly four years in security engineering across both.

CERTIFICATIONS: ISO 27001:2022 Lead Auditor · PCI DSS v4.0 Lead Implementer
BASE: Bengaluru and Delhi NCR · Remote · US hours proven
FOCUS: GRC engineering and applied AI for regulated products

Build with me.

Hiring for GRC engineering, applied AI, or something between: my inbox is open.

EMAIL ME

dhruv.shahi07@gmail.com

LINKEDIN ↗GITHUB ↗