Security & data
What we do with your GST data
Plainly: what is in place today, and what we will have in place before the first paid customer. No badges we have not earned.
In place today
- Application data stored in India (Mumbai region)
- Every query is scoped to the signed-in account; automated tests check that one account cannot reach another's data
- Sign-out after 30 minutes without activity, and after 24 hours in any case
- Every edit to a stored purchase register line is logged with who, what and when
- Client view: invite-only, email one-time codes, view-only, removable at once, every view and download logged
- No analytics, advertising or session-recording tools in the application
Before the first paid customer
- Account isolation enforced in the database as well as in the application
- Paid database plan with backups
- AI features on an India region with no training on your data
- Data processing terms and privacy notice settled by a practising advocate
- Independent security review of the client view
Your role and ours
When you upload registers and notices, you decide why the data is processed; under the Digital Personal Data Protection Act, 2023 you are the data fiduciary for personal data inside them, and CharteredX processes it on your instructions. For the account data of your users (name, work email, sign-in records), CharteredX is responsible for it.
Working paper, not advice
Reconciliation results, computed figures and drafts are a working paper built from the data you supply. Check them against the GST portal and your records before you claim, reverse, pay or reply.
Questions about security or data: support@charteredx.in.