MeitY-Empanelled Cloud Providers Explained

Quick answer: MeitY empanelment is a government procurement panel: a cloud provider's services and Indian data centres are audited by STQC and then listed on MeitY's AMBUD portal, which on 24 October 2026 showed 30 providers. You need an empanelled provider if you sell to government or to SEBI-regulated firms, or if a contract demands it. Banks and payment firms follow separate RBI rules. Everyone else can choose Indian regions of Amazon Web Services, Google Cloud or Microsoft Azure.

How we researched this: We read MeitY's AMBUD portal (the empanelled-provider table, FAQs and process), MeitY's Guidelines for Procurement of Cloud Services (March 2026), a PIB release of 12 December 2025, SEBI's June 2025 FAQ on its cloud framework, RBI's payment-data storage FAQ and its IT outsourcing Directions, the DPDP Act and Rules on meity.gov.in, and cloud providers' region pages. Everything is as checked in October 2026.

What "MeitY-empanelled" means, and what it does not

Empanelment is how the Ministry of Electronics and Information Technology (MeitY) prepares a list of cloud services that government bodies can buy. The AMBUD portal describes itself as an online platform for empanelment of cloud services of Cloud Service Providers and registration of data centres. The path has several steps, per the portal's FAQ: the provider applies on four criteria (pre-qualification, technical requirements, compliance and standards), MeitY evaluates, the Standardisation Testing and Quality Certification (STQC) Directorate audits the data centres and services, the Secretary of MeitY approves, a Letter of Empanelment is issued, and the services are onboarded on the Government e-Marketplace (GeM).

The entry bar is high. The AMBUD FAQ lists pre-qualification conditions such as being a company incorporated in India that has operated for at least three consecutive years, positive net worth in the previous two years, cumulative revenue of at least INR 10 crore from cloud or data-centre hosting in the previous two financial years, an uptime SLA of 99.5%, and a data centre in India with at least 100 operational racks or 1 MVA IT load, conforming to at least Tier III and certified for ISO 27001. Certifications marked mandatory include ISO 27001, ISO 20000-1, ISO 27017 and ISO 27018; SOC 1, SOC 2 and PCI DSS are listed as optional. Each empanelled provider also faces a yearly surveillance audit, and renewal needs an undertaking to MeitY three months before expiry.

Two points matter to a buyer. First, empanelment attaches to specific services and data centres, not to a company's whole brand. Second, MeitY's own Guidelines for Procurement of Cloud Services describe themselves as advisory, prepared for Government Departments, and say that empanelled services are published through a GI Cloud Services Directory for use by government departments. They are not a law that binds a private company.

Who is on the list today

The AMBUD "Empaneled CSPs" page lists the providers in a table. A caution: the page's own header says "Showing all 23 cloud service providers", but the table itself had 30 numbered entries when we read it on 24 October 2026, and a PIB release from 12 December 2025 said MeitY had empanelled 26. Counts move as providers are added, so use the portal's table and its "Empanelment Validity" column, not a number from an article.

In that table, 29 providers show STQC audit status "Audited" and one (ITI Limited) shows "In Progress". The same page has a "Public Pricing" tab: 21 providers are marked as publishing pricing with a link, and 9 are not. Here are selected entries as published on AMBUD:

GCC stands for Government Community Cloud, which AMBUD describes as physically and logically isolated infrastructure for government use. Public Cloud and Virtual Private Cloud are the models a commercial buyer would normally relate to. You can browse these providers on App Advisor: Oracle Cloud Infrastructure, Tata Communications Cloud, Jio Cloud Services, E2E Networks, Yotta, ESDS, Sify Cloud and Web Werks (Web Werks India Private Limited is also on the AMBUD table). See our cloud platforms category for others.

Who actually has to use an empanelled provider

Government customers. MeitY's procurement guidelines say that SaaS offered under empanelment must be served only from data centres audited and qualified by STQC, and that the provider is responsible for ensuring all data functions and processing are performed within the boundaries of India. If you sell software to a ministry, state department or PSU, expect the tender to ask for this.

SEBI-regulated entities. A SEBI FAQ on its cybersecurity and cloud frameworks (June 2025) says regulated entities must ensure the provider uses only MeitY-empanelled infrastructure, and that storage and processing of data, including logs, happens in data centres of MeitY-empanelled providers with valid STQC certification or equivalent audit status. Where a provider only lets you pick a region, the entity must get assurance that every data centre in that region meets the STQC requirement. The FAQ also says PaaS and SaaS providers' agreements should flow the compliance down to subcontractors, and gives the example of global CDNs or edge networks. If your SaaS serves stockbrokers, mutual funds or other SEBI-regulated firms, this affects your hosting and sub-processor list. The framework itself is SEBI's circular of 6 March 2023, numbered SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033.

RBI-regulated entities. The RBI (Outsourcing of Information Technology Services) Directions, 2023 took effect on 1 October 2023. The text we read does not name MeitY empanelment. It does require that agreements cover, among other things, "storage of data (as applicable to the concerned REs) only in India as per extant regulatory requirements", effective access to data and logs, and audit rights. Its cloud appendix asks regulated entities to cover the whole data lifecycle in their outsourcing policy, treat cloud security as a shared responsibility, prefer an architecture where encryption keys and hardware security modules are under the entity's control, retain relevant logs for incident handling, and define an exit strategy that includes secure purge of data at the provider.

Payment data. This is its own rule. RBI's circular of 6 April 2018 directed all payment system providers to store the entire payment data only in systems located in India. RBI's FAQ says the direction also applies to transactions through payment gateways, third-party vendors and other entities in the payments ecosystem retained by authorised entities, and defines the data to include customer data (name, mobile number, email, Aadhaar number, PAN), payment credentials such as OTP, and transaction data. Processing abroad is allowed only if the data is deleted abroad and brought back to India within one business day or 24 hours, whichever is earlier. A System Audit Report from a CERT-In empanelled auditor is part of compliance. If your SaaS touches payment instructions, this rule matters more than MeitY empanelment. Our guide to payment aggregators in India covers the licensing side.

Personal data in general. Under the DPDP Act, section 16 lets the Central Government restrict transfers of personal data to notified countries or territories, and Rule 15 says transfers abroad are subject to requirements the Government may specify. Rule 13(4) says a Significant Data Fiduciary must ensure that personal data specified by the Government, and associated traffic data, is not transferred outside India. None of this makes MeitY empanelment mandatory for private firms, but it does mean a hosting region in India is the lowest-risk default. See our guide to DPDP Act compliance software and India data residency for SaaS.

Choosing regions at the big clouds

Most private SaaS firms do not need an empanelled provider, but they do want Indian regions. Google Cloud documents Mumbai (asia-south1) and Delhi (asia-south2) among its zones. AWS lists Asia Pacific (Mumbai) as ap-south-1 and Asia Pacific (Hyderabad) as ap-south-2 in its Regions documentation. On AMBUD, Microsoft's entry lists Chennai, Mumbai and Pune and Oracle's lists Navi Mumbai and Hyderabad. For a Pune company that wants low latency, a Mumbai region is the common starting point. If you are weighing the bill as well as the compliance, read our guide to reducing AWS hosting costs in India, and see Google Cloud Platform and Amazon Web Services listings.

An important gap to close: choosing an Indian region does not tell you whether every service you use is covered by empanelment. AMBUD shows which service families (basic, advanced, managed) each provider has empanelled. Microsoft's AMBUD entry, for instance, shows basic services only. If you use an AI service, a managed analytics product or a global CDN, ask the provider whether it falls within the empanelled scope and where its data and logs are processed. The SEBI FAQ's CDN example shows why.

Indian providers can look different on paperwork. E2E Networks's pricing page carries a "MeitY Empaneled" label and states that its prices exclude GST, and its billing FAQ says Indian customers can pay via UPI, net banking and popular wallets. AWS India, by comparison, invoices in rupees to accounts with an Indian billing address; its Marketplace FAQ says card payments with AMEX, MasterCard, RuPay or Visa are accepted and that NetBanking and UPI are currently not available. Payment method can matter to a small company's accounts team.

Which customer needs which hosting

Three short scenarios show how this plays out. A 15-person Pune SaaS firm bidding for a state government portal should pick a provider whose AMBUD entry covers the service families it uses, and price the project on that basis. A Mumbai wealth-tech platform selling to SEBI-regulated brokers needs its sub-processor map reviewed (CDN, email, logging) because the SEBI FAQ applies back-to-back to subcontractors. An Indore D2C brand using a Shopify-style storefront has no obligation under MeitY empanelment and should concentrate on the DPDP basics.

Questions to put to any "MeitY-ready" claim

1. Which exact service names are on your Letter of Empanelment, and what is the validity date shown on AMBUD?
2. Which data centres (city and count) will run my workload, backups, and logs?
3. Is the disaster-recovery site also inside India? (Yotta's AMBUD entry, for example, marks its Guntur site "for DR service only".)
4. Which sub-processors, CDNs and support tools see my data or logs?
5. Can you show STQC audit status and your last surveillance audit?
6. What does exit look like: export format, deletion proof and timelines (the RBI Directions ask for secure purge at the provider)?
7. How is billing done: rupee invoices, GST invoice details, and payment methods?

Our software demo checklist for Indian buyers and backup and disaster recovery for SMEs extend this list.

FAQs