Security

You're uploading Form 16s, bank statements, and PAN details. Here's how we protect that, and how to tell us if you find a problem.

Single-region hosting

All data — documents, computed Tax Reviews, account records — lives in Firebase's asia-south1 (Mumbai) region. No multi-region replication, so there's one jurisdiction to reason about, not several.

Encryption

Data is encrypted in transit (TLS) and at rest, using Firebase's standard infrastructure encryption for Firestore and Cloud Storage.

Access control

Every read and write goes through server-side Firestore security rules and role-gated Cloud Functions — a CA or family member only sees what you've explicitly shared, scoped to the assessment years and accounts you picked.

App Check

Callable endpoints are gated by Firebase App Check, so requests must come from the real Chitragupt app — not a replayed token or a script hitting the API directly.

Audit trail

Every account mutation — uploads, confirmations, shares, deletions — writes an audit-log row, retained for 7 years, so any access to your data is traceable.

Erasure on request

Deleting your account under DPDP §12 walks every collection your data touches — documents, computed reviews, shares, audit trail — not just the account record.

Report a vulnerability

Found a security issue — an access-control gap, a way to see another user's data, an authentication bypass? Email support@chitragupt.ai with steps to reproduce. We reply within our standard support SLA and won't take legal action against good-faith reports that don't access, modify, or exfiltrate other users' data beyond what's needed to demonstrate the issue.