If you build software for central or state government bodies or public sector undertakings, where it runs is a procurement question before it is an engineering one. The Ministry of Electronics and Information Technology operates an empanelment scheme, administered through the STQC directorate, that certifies which cloud providers may serve government customers. Most central and state cloud procurement defaults to empanelled providers, with narrow alternative paths for certain defence and intelligence workloads. Private sector buyers are free to use anyone.
The distinction that catches teams out is what empanelment actually covers. STQC audits a provider against a defined catalogue of services that the provider submits — it validates infrastructure against security, audit and operational standards, not your particular workload. Newer services and anything in preview typically sit outside the audited scope. So a provider being empanelled tells you very little on its own: the question your buyer will ask, and the one you must be able to answer, is whether the specific services your architecture depends on are inside the empanelled catalogue and available in the right Indian region.
The major providers are empanelled with named Indian regions — AWS in Mumbai and Hyderabad, Azure across its central, south and west India regions, Google Cloud in Mumbai and Delhi — alongside a number of Indian providers. Empanelment typically runs for three years with annual surveillance, and lapses require reapplication and a fresh audit. That renewal cycle matters for long government contracts: a provider whose empanelment expires mid-engagement is a contractual problem you inherit.
Design accordingly and early. The practical consequence is that a government project constrains your service catalogue in a way commercial projects do not. The managed service that would have saved you three weeks may not be in scope, and discovering that during a security review rather than during architecture means redesigning under deadline. Build the list of services you intend to use, check each against the empanelled catalogue for your chosen region, and get that written into the proposal rather than assumed.
Empanelment is also a floor rather than a ceiling. Buyers frequently layer additional requirements on top — a CERT-In empanelled auditor's report, STQC certification of the application itself, specific accessibility standards, or an independent security assessment. Reading the tender carefully for those, and pricing them, is the difference between a profitable government contract and one that consumes the margin in compliance work nobody quoted for.
The commercial reality worth naming is that this raises the cost of entry and reduces the competition. A firm that has done one government project properly, with the audits and the documentation to show for it, is in a considerably stronger position on the next tender than one starting from zero. If public sector work is a direction you want, treat the first engagement as an investment in the capability rather than as a job to be won on price.
