Built for the records a CA firm holds

Signing in

• Every member of a firm's staff signs in with a password and a second factor — an authenticator app or a passkey. It is compulsory and cannot be switched off by anyone.
• Clients sign in with a password and a one-time code sent to their email each time.
• Repeated wrong passwords slow down, then pause, the next attempt. Sessions end after a period of inactivity and when the browser closes.
• Recovery codes are shown once and stored only as hashes: nobody, including Aevantos, can read them back.

Keeping firms apart

• Every record belongs to one firm, and every request is checked against the signed-in person's own firm before anything is read or written.
• Inside a firm, practice groups wall clients off from staff outside the group, for independence.
• Each firm has its own address and its own branding; a signed-in person only ever sees their own firm.

Documents

• Documents are stored privately and handed out only through a check of who is asking, at the moment they ask.
• Every version is kept and sealed with a SHA-256 fingerprint, so any later change to a file is detectable.
• Clients see only what the firm has marked as shareable with them.

Where the data lives

• Documents are stored in Mumbai, India, and the application runs there; the database is in Singapore, with Neon.
• Connections are encrypted in transit; pages are served with a strict content policy and are never framed by another site.
• Personal data is kept out of the application's logs.

Who did what

• Sign-ins, changes to clients and filings, document access and billing actions are recorded with who did them and when.
• Filing is always done by a person: Sakshra prepares and records; it never files a return or uses a DSC on its own.

Your data is yours

• Export everything — clients, registrations, filings, invoices, documents — at any time, from Settings.
• If your subscription ends, the workspace becomes read-only and export stays open for 180 days.
• Sakshra never deletes a firm's data on its own. A firm that wants its data deleted asks, and it is deleted.
• Under the DPDP Act your firm is the data fiduciary for its clients' data, and Aevantos processes it on your behalf. Your firm approves the privacy notice its clients see.

What is still to come

Nightly encrypted backups held with a second provider, an independent penetration test, and malware scanning of uploaded files are being put in place before Sakshra holds firms' live data at scale. Found a weakness? Write to info@aevantos.com — please do not include real client data.