Security

Every page and every request uses HTTPS, with HSTS so browsers never fall back to plain HTTP.

The application and its database run on a server in Mumbai. The website is served through Vercel, whose network may carry traffic through locations outside India. Every service provider is listed in the Privacy policy.

The database is backed up every night, and each backup is encrypted.

When you finalise a year, its statements are saved as a fixed copy with a fingerprint (hash). Changing them means reopening the year, and that is recorded.

Passwords are stored only as bcrypt hashes. They must be at least 10 characters, and they are checked against a list of common passwords.

You stay signed in with an HttpOnly, Secure, SameSite cookie. A session lasts 14 days from your last activity, and you can sign out any device from Settings > Security.

Sign-in, sign-up and password reset are rate limited. One email address gets at most five sign-in attempts in 15 minutes.

Our administrator can open a firm's data only after entering a one-time code, and every view is logged.

Each firm sees only its own records. Asking for another firm's record gets the answer "not found", and this is tested on every route.

Staff see only the clients assigned to them, unless the owner gives them access to all clients.

Sign-ins, client changes, team changes, Tally imports and finalising are recorded against the person who did them.

The connector accepts messages only from autofs.in, runs only read-only exports, and works only after it is paired with your account.

Payments, when they open, go only through Razorpay checkout; we never see or store card details.