Where your data lives, and who can touch it
Your firm is the Data Fiduciary for your investors' data. We are your Data Processor, and we sign a Data Processing Agreement before we see a single record. This page summarises what that agreement covers.
Hosting In place
The platform runs on a dedicated virtual private server in Mumbai, India. Traffic to and from it is encrypted in transit with TLS.
Isolation Before first client
Each firm gets its own isolated workspace. No firm can see another firm's data, and we never use client data in demos, screenshots or training material.
Access log Before first client
Every access we make to your data is recorded with the person, the time and the reason. The log is yours to review at any time.
Backups Before first client
Daily backups, stored away from the main server and test-restored on a schedule.
Passwords In place
We never ask for, hold or store your email, RTA mailback or exchange passwords. You enter them yourself. Where we work inside your accounts, we do so under a signed access-authority letter, and every session is logged.
RTA statements In place
Read only inside a mailbox your firm owns, by a script you authorise, limited to RTA senders. You can revoke that authorisation at any time.
Aadhaar In place
Stored as the last four digits only. Full Aadhaar numbers are never kept in the CRM or the platform.
Breaches In your DPA
If a personal data breach affects your data, we notify you without delay and within the timeline set in your Data Processing Agreement, so that you can meet your own obligations.
Leaving In place
Export your data in standard formats at any time. When you leave, we delete it and give you a deletion certificate.
Companies that process data for us
Listed in every Data Processing Agreement. We tell you in advance before adding a new one.
| Company | What it does | Used for |
|---|---|---|
| Hostinger | Server hosting, Mumbai | Hosted platform, this website |
| Zoho | CRM, forms, mail, Catalyst functions | Built-for-you and Owned builds, enquiries |
| Pabbly | Workflow automation | Moving data between your apps, where you choose it |
| Anthropic | AI drafting (Claude) | Content Desk and Content Engine only, disclosed before go-live |
| Google (our dedicated account) | Editing a Sheet you share with us | Writing Content Desk drafts into the Sheet in your own Google account |
| Your own Gmail and Apps Script | RTA statement ingestion, under your own Google account |
Google services used for RTA ingestion run under your firm's own Google account, which you contract with directly. We list them separately in the Data Processing Agreement.
What we do not claim
We do not claim that any software makes a firm compliant. Your firm stays responsible for its SEBI, AMFI, IRDAI, PFRDA and data protection obligations. We do not yet publish an uptime figure; we will after measuring it for at least 60 days. An independent security assessment is on our roadmap.
Ask for the Trust Pack
Our Data Processing Agreement template, sub-processor list, security summary, data exit policy and a sample access log, sent with every proposal.
Request the Trust Pack