Security
CA firms handle some of the most sensitive documents their clients own: bank statements, PAN, Aadhaar, salary and tax records. This page explains, in plain terms, how we protect them.
Encryption
- Every document, invoice and backup is encrypted with AES-256-GCM before it is written to storage.
- All traffic uses HTTPS with HSTS. Plain HTTP is never accepted.
- API keys and passwords for connected services are stored encrypted and are never shown in full again after they are saved.
Access control
- Each firm's data is isolated at the database layer. Automated tests that try to read another firm's data run on every release.
- Staff see only the clients assigned to them. Billing is visible only to the firm owner.
- Passwords are hashed with Argon2id. Two-factor authentication with an authenticator app is available for every user and mandatory for our own administrators.
- Clients never get an account. Each upload link belongs to one request, expires, and requires a one-time code sent to the client's registered mobile or email.
Files
- Downloads use signed links that expire within ten minutes.
- Uploaded files are checked by their actual content, not their name, and scanned for malware before they are stored.
- Location and device data (EXIF) is removed from photos.
Automated reading
To identify documents and extract data, Docflo reads text from PDFs on our own servers first. Where a document needs automated reading by an AI provider, PAN- and Aadhaar-like numbers are masked by default, the data is sent over an encrypted connection, and it is not used to train models. Nothing is ever filed or submitted to any government portal on your behalf.
Monitoring and recovery
- Sensitive actions — downloads, deletions, settings changes and administrator access — are recorded in an audit log.
- The database and document store are backed up every day to a separate location and kept for 14 days. Restores are tested.
- Deleted documents can be recovered for 30 days before they are removed permanently.
Your data, your control
Firm owners can export all their data at any time as a ZIP file, and can ask for their account to be deleted. See our privacy policy for details. To report a security issue, write to hello@docflo.in.