CA Assist (caassist.app), operated by Cognitive Automation
1. Our role
| Data | Who decides how it is used | CA Assist's role |
|---|---|---|
| CA firm accounts, billing and verification data | CA Assist | Data Fiduciary |
| Clients' names, phone numbers, GSTIN/PAN and documents that a CA firm keeps in CA Assist | The CA firm | Data Processor, acting only on the firm's instructions under our Data Processing Agreement |
2. Laws and rules we follow
| Framework | What it requires | How CA Assist meets it |
|---|---|---|
| Digital Personal Data Protection Act 2023 and DPDP Rules 2025 (phased in from 13 November 2025; main duties from May 2027) | Notice and consent, purpose limitation, reasonable security safeguards, breach notification to the Data Protection Board and affected people, rights of access, correction, erasure, grievance and nomination, written processor contracts, deletion when purpose ends | Privacy Policy and Data Processing Agreement published and accepted at sign-up with a versioned record; data used only for stated purposes; safeguards in section 4; breach runbook in section 6; rights handled through the Grievance Officer; deletion after the 60-day export window; processing logs kept for at least one year |
| Information Technology Act 2000, s.43A and SPDI Rules 2011 | Published privacy policy, consent for collecting sensitive personal data (including financial information), reasonable security practices, Grievance Officer | Privacy Policy, sign-up consent, documented security controls, a designated Grievance Officer |
| IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, as amended up to 2026 | Rules of use telling users what they must not share; a reminder of those rules at least every three months; a Grievance Officer who acknowledges within 24 hours and resolves within 7 days (36 hours for unlawful content, 2 hours for intimate images); appeal to the Grievance Appellate Committee; action on lawful orders; keeping removed content's records for 180 days; reporting offences | Terms of Use with the full list; reminder sent to every user every three months; published Grievance Officer, timelines and appeal route; records preserved and offences reported as the Rules require |
| CERT-In Directions (28 April 2022) | Report specified cyber incidents within 6 hours, keep ICT logs for 180 days in India, synchronise clocks | Incident runbook with a 6-hour clock; audit logs stored in India; server logs kept for one year in India (AWS Mumbai); clocks synchronised by NTP (Amazon Time Sync Service) |
| Payment and Settlement Systems Act 2007 and RBI payment aggregator guidelines | Only authorised entities may pool or settle other people's payments | CA Assist never touches client money: clients pay the CA firm's own Razorpay account. CA Assist collects only its own subscription fees, through Razorpay, and never sees card, UPI or bank details |
| GST (CGST, SGST and IGST Acts) | Tax invoices with correct place of supply, gapless invoice numbering per financial year, credit notes for refunds | 18% GST on plans, included in the prices shown; CGST+SGST or IGST by the buyer's state; invoices numbered CAA/YYMM/serial (credit notes CN/YYMM/serial), one gapless series per financial year; buyer GSTIN printed for input tax credit; credit notes for refunds |
| Information Technology Act 2000 (s.10A) and Bharatiya Sakshya Adhiniyam 2023 (s.63) | Contracts made electronically are valid; an electronic record is admissible with a certificate that includes its hash value | Terms and policies accepted by click-through; each acceptance recorded with the document version, the SHA-256 fingerprint of its exact text, time, IP address and browser; every published version kept unchanged |
| Consumer Protection (E-Commerce) Rules 2020 | Mainly for sales to consumers | CA Assist sells to businesses only; refund, cancellation, contact and grievance details are published anyway |
| Meta WhatsApp Business terms and messaging policies | Opt-in before messaging, easy opt-out, templates only for approved purposes, no requests for sensitive identifiers in chat | Consent recorded per contact; STOP opts out immediately; the assistant only delivers documents and service messages and never asks for PAN, Aadhaar, card or bank details |
| ICAI Code of Ethics (binds CA firms) | Confidentiality of client information; restrictions on advertising and on sharing fees | Strict firm-by-firm isolation and confidentiality; no advertising to a firm's clients; referral rewards are software credits on CA Assist subscriptions, never a share of professional fees |
3. Where data lives
- Databases and document storage: India, Mumbai (AWS ap-south-1). The database and sign-in service (Supabase) also run in Mumbai.
- Limited data leaves India only where a provider needs it to do its job: WhatsApp message delivery (Meta), email delivery (Resend, Japan (Tokyo)), and Sign in with Google for users who choose it. The full provider list is in the Privacy Policy.
4. Security controls
| Area | Control |
|---|---|
| Firm isolation | Every firm's records are separated by row-level security enforced by the database, including for background jobs; cross-firm isolation tests run automatically on every code change |
| Encryption | HTTPS/TLS for all traffic; encryption at rest for the database and document storage |
| Sign-in | Managed authentication; optional two-factor authentication (authenticator app); sign-in with Google; automatic sign-out after 7 days without use; unique accounts per person |
| Permissions | Owner, admin, staff and viewer roles; billing and payment settings limited to owners; approval settings per document type |
| Documents | Virus-scanned before storage; delivered only to the client and contact they belong to, matched on exact identifiers (never by guesswork); expiring, revocable download links; every send and download logged |
| Payment data | Card, UPI and bank details go only to Razorpay; CA firms' gateway keys are stored encrypted and never shown again after saving |
| Secrets and infrastructure | No long-lived keys on servers (short-lived cloud roles); secrets in an encrypted managed store; administrative server access through audited sessions only; container images scanned on build |
| Audit trail | Append-only audit log of sensitive actions (who, what, when): the application cannot edit or delete entries |
| Software quality | Automated tests, including cross-firm isolation tests, run on every code change |
| Data we refuse to hold | GST or Income-tax portal passwords, card numbers, bank account numbers and Aadhaar numbers are never collected or stored |
5. Clients' consent and rights (for CA firms)
- CA firms are responsible for their clients' consent. CA Assist records WhatsApp opt-in per contact and honours STOP immediately.
- A client who writes to CA Assist about their data is referred to their CA firm, and we help the firm respond.
- CA firms can export client lists and payment records at any time, and can request a full export (including documents) until 60 days after closing their account.
6. Incidents and breaches
- Detect and contain (revoke credentials, isolate the affected firm, block the channel).
- CERT-In: report reportable incidents within 6 hours of becoming aware.
- CA firms: tell affected firms promptly with the facts they need for their own obligations, and support them.
- Data Protection Board and individuals: where CA Assist is the Data Fiduciary, notify the Board without delay and give the detailed report within 72 hours, and inform affected people, as the DPDP Rules require.
- Review the cause and fix it; record the timeline from the moment we became aware.
7. Retention
| Data | Kept for |
|---|---|
| Firm documents and client data | Until the firm deletes them; after closure, 60 days for export, then deleted |
| GST invoices and payment records | 8 years (tax law) |
| Security and access logs | At least 1 year, in India |
| Legal acceptances and consent records | Life of the account plus 3 years |
8. Contacts
- Grievance Officer and data protection contact: Grievance Officer, Cognitive Automation, Gujarat, India, at admin@caassist.app (or the contact form). Acknowledgement within 24 hours, resolution within 7 days; appeal to the Grievance Appellate Committee (gac.gov.in) within 30 days.
- Security reports: admin@caassist.app. Please give us reasonable time to fix an issue before disclosing it.
- Billing: admin@caassist.app