Security you can trust. Engineered for statutory compliance.
How CA Assist safeguards confidential client tax returns, GST computations, and partner audit trails from unauthorized access.
How the platform is protected
Every layer of the platform is designed against statutory disclosure hazards and cyber liability under Section 43A of the IT Act.
Data hosted in India
Documents and the database are hosted in Mumbai (AWS ap-south-1 and Supabase ap-south-1). The few service providers outside India, such as our email provider, are listed in the Privacy Policy.
Encrypted in transit and at rest
TLS in transit and AES-256 encryption at rest for files and the database. Payment-gateway and WhatsApp credentials are also encrypted by the application, with a key kept in AWS Systems Manager.
Tenant isolation
Every record carries its firm, and PostgreSQL row-level security, forced on every firm table, lets a session see only its own firm. Automated cross-tenant tests run on every change.
Audit trail
Append-only logs of document dispatches, fee payments, approvals and settings changes. The application can add entries but has no permission to edit or delete them.
Two-factor sign-in
Every firm user can add an authenticator app as a second sign-in step, and CA Assist staff must use one. Client download PINs and passkeys are coming soon.
No portal passwords stored
We never request or store client Income Tax or GST portal passwords. All workflows operate via client-authorized document pushes and direct webhooks.
How your documents are protected
Statutory tax audits (Form 3CD), computation sheets, and monthly GSTR-3B filings carry severe fiduciary liability. Every delivery passes a send guard that re-checks the client, the number and the payment, and download links expire. Watermarking and PIN protection are coming soon.
Dynamic Statutory Stamping (coming soon)
Every downloaded page is dynamically stamped across the diagonal with the authorized recipient's PAN/GSTIN, mobile number, Indian Standard Time timestamp, and unique dispatch serial number.
Revocable Expiring Links
Client download links expire after 24 hours and allow at most 3 downloads. Deleting a document ends its links at once.
Recognised numbers only
The assistant sends a document only to a WhatsApp number the firm has registered for that client. Any document type can also be set to wait for a partner's approval before it goes out.
Right document, right client.
Six checks stand between a request and a delivery, so a return never goes to the wrong client, even when trade names look alike.
Client Request
Client texts WhatsApp bot from their registered authorized mobile number.
WhatsApp Verification
The sender's number must belong to a registered contact who has agreed to receive documents.
Document Match
System cross-matches client PAN/GSTIN with exact statutory filing tax period.
Send Guard & PIN
Confidentiality check executed; 4-digit decrypt PIN dispatched securely (coming soon).
UPI Settlement
The client pays the fee through the firm's own Razorpay account.
Guarded delivery
The send guard re-checks everything, sends the file and writes an audit entry.
Who can see what
Four roles decide who can do what. Only the owner manages billing or marks a fee as paid; viewers can look but not change anything.
| Role Type | Manage Billing | Approve Dispatches | Waive Fees | View Audit Logs | Download Vault Files |
|---|---|---|---|---|---|
Owner Runs the firm's account | check_circle | check_circle | check_circle | check_circle | check_circle |
Admin Manages the team and settings | remove | check_circle | remove | check_circle | check_circle |
Staff Prepares, uploads and approves | remove | check_circle | remove | remove | check_circle |
Viewer Read-only access | remove | remove | remove | remove | check_circle |
Controls in place today
What protects your data now, and the independent checks we have planned.
Automated tests prove that one firm can never read another firm's clients, documents or requests.
Payment and WhatsApp notifications are accepted only with a valid signature, and each one is processed once.
An independent SOC 2 audit is on our roadmap. We will publish the report here when it is done.
A penetration test by a CERT-In empanelled auditor is planned before general availability.
Have security requirements or a questionnaire for us?
We answer security questionnaires, sign our Data Processing Agreement and support your DPDP due diligence.