🔐
Encryption
Secure HTTPS/TLS in transit, and protected storage on managed infrastructure.
🔒 Security & Privacy
Your Data. Your Business. Your Control.
We protect your business information with security and privacy built into the platform from the ground up. From GST and accounting records to invoices, customer information and payroll data, your information is protected through secure communication, controlled access, tenant isolation and auditability.
Your data is your data
Your business data belongs to you.
We design our platform so that your financial, GST, accounting, payroll, invoice, customer and business information is protected using multiple layers of security. We do not treat your business data as a product. Your data is stored securely, access is controlled, and your company's data is isolated from other customers.
Security by design
Your business data. Protected by design.
Security and privacy are built into the platform from the foundation — not added as an afterthought. Your data is protected through multiple layers, not one security feature.
Your business dataGST, invoices, accounting, payroll, customers
Encrypted channelHTTPS/TLS in transit, HSTS enforced in production
AuthenticationPassword + MFA, hardened sessions
Role-based access8 roles across granular, service-checked permissions
Tenant data isolationPer-company boundary, PostgreSQL row-level security
Database & infrastructureManaged database, data kept in India, backups
Audit & monitoringImmutable log of who changed what, and when
Protection at every layer
Each of these is a control that is actually part of the product today.
🏢
Tenant Isolation
Your company's data is logically separated from every other business.
👤
Access Control
Only authenticated, authorized users reach the information they're permitted to.
🛡️
Multi-Factor Auth
An authenticator-app second step adds protection beyond the password.
📋
Audit Trail
Important actions are recorded — who, what and when — for accountability.
💾
Backup & Recovery
Managed backup and recovery procedures help reduce the risk of accidental loss.
01 · Data protection
Sensitive business information, treated as a core requirement
The platform handles the information a business most needs to keep safe. Because of that, security and privacy are treated as a core product requirement — not a setting.
- GST information
- Invoices
- Customer information
- Supplier information
- Financial transactions
- Bank information
- Payroll information
- Employee information
- Reimbursement documents
- Accounting records
- Business reports
02 · Encryption
Is my data encrypted?
Yes — data protection is implemented across the application and infrastructure using encryption and secure communication. It helps to distinguish two things:
🔁
Data in transit
Information transferred between your browser or app and our servers is protected using secure HTTPS/TLS communication, with HSTS enforced in production so connections stay encrypted.
🗄️
Data at rest
Stored business information is protected using the encryption and security capabilities of the underlying managed database and cloud infrastructure it runs on.
We deliberately don't claim a specific encryption algorithm we can't verify end to end. The wording reflects what is actually implemented.
03 · Tenant isolation
Can another company see my data?
No. Each business operates within its own isolated data environment.
- Every company has its own logical data boundary. Users can access only the company data they have been authorized for.
- Tenant-level access controls are designed to prevent one company's information from being exposed to another. Our architecture enforces strict tenant isolation at both the application and database levels.
- Database-level row security — PostgreSQL row-level security is enabled on every company-scoped table, providing an additional layer of tenant isolation beyond application checks.
04 · Authentication
Secure account access
Getting into an account is protected by several mechanisms working together:
- Multi-factor authentication (authenticator app)
- Secure password authentication
- Google sign-in where enabled, verified server-side
- Session security with server-side logout
- Rotating refresh tokens with reuse detection
- Brute-force protection
- Account lockout after repeated failed logins
05 · Access control
Who can access my business data?
Access is controlled through authentication, role-based permissions, company- and location-level controls, MFA, session security and audit logging. Within your own organisation, each employee only receives the permissions you assign them.
| Role | What they can reach |
|---|---|
| Owner | Full access — including confidential fees and business settings |
| Manager | Management access across the company's operations |
| Accountant | Accounting, GST and reporting access |
| Store keeper | Inventory and location-scoped access only |
| Read-only | View-only access, no changes |
These are examples — the product ships 8 roles across granular permissions, checked in the service layer, so the line sits exactly where your business needs it.
06 · Infrastructure security
Protected foundations
The platform runs on managed cloud infrastructure with your data kept in India.
- Managed PostgreSQL database with row-level security per company and versioned, reviewed schema changes.
- Security headers — a content security policy, anti-clickjacking protection and HSTS are applied in production.
- Duplicate-safe operations — idempotency keys prevent a network retry from posting the same transaction twice.
07 · Backup & recovery
Your data is protected against operational failure
Business data is backed up according to our backup and recovery procedures to help protect against accidental loss and infrastructure failures.
We describe this as a procedure rather than a promise of zero data loss, instant recovery or unlimited, permanent backups — because honest security means saying what the infrastructure actually does.
08 · Audit logs
Every important change can be tracked
The platform maintains an immutable audit trail for important system changes, giving your business greater visibility and accountability over its financial records.
- Who performed the action
- What was changed
- When it was changed
- Previous value
- New value
Posted entries have no edit or delete path — corrections are new, linked postings, so the record can be trusted, not just believed.
09 · Data retention
What happens if I stop using the platform?
When a subscription or trial period ends, the account moves to read-only — you are not locked out, and it can be extended or converted to a paid plan. Your data stays available to view and export during that period.
The exact data retention and deletion timeline is defined in our Privacy Policy and applicable service terms.
10 · Data export
You remain in control of your business information
The platform is built to help you manage your own business information — access it, export it, manage users and permissions, and handle deletion and retention according to policy.
Every return, register, ledger and report exports to Excel and PDF — GSTR-1, 3B and 9, sales, purchase and expense registers, debtors and creditors ledgers, Trial Balance, P&L and Balance Sheet — so your data stays portable, not locked in. Access to customer information is controlled and limited according to our security, operational and support policies.
11 · Data deletion
Deletion, on your terms
You can request deletion of your business data through our security contact. When data is permanently deleted is governed by our retention and deletion policy.
Our data retention and deletion policy is set out in our Privacy Policy and applicable service terms.
12 · Privacy policy
Where the details live
Our Privacy Policy sets out how business information is collected, used, retained and deleted, and the rights that apply to it.
Read the full Privacy Policy — written in plain business language and aligned with India's DPDP Act, 2023.
13 · Security contact
Reach our security team
For security questions, data-export or deletion requests, or to report a concern:
Security isn't a feature. It's a responsibility.
Your business trusts us with information that matters. That's why security is built into the architecture — from authentication and access control to tenant isolation, auditability and infrastructure protection. We continuously work to keep your business information protected.
Your questions, answered
Data privacy — your questions, answered
Plain answers, in business language. Finkitaabh sells software, not your data.
Is my financial data safe?
We protect your business information with multiple layers of security — encrypted connections, authenticated logins, role-based permissions, per-company data isolation and an immutable audit trail. Your financial records are guarded at several steps, not by a single feature.
Is my data encrypted?
Yes. Information moving between your browser and our servers travels over secure HTTPS/TLS connections, with HSTS enforced in production. Stored business data is protected using the encryption and security capabilities of the managed database and cloud infrastructure it runs on. We describe this the way it is actually implemented rather than claiming a specific algorithm we can't verify end to end.
Can another company see my data?
No. Each business operates within its own isolated data environment. The platform enforces tenant-level access controls, and PostgreSQL row-level security is enabled at the database on every company-scoped table — an additional layer of isolation beyond application checks. Users can access only the company data they are authorized for.
Can your employees see my data?
Access to customer information is controlled and limited according to our security, operational and support policies. Where support access is needed to help resolve an issue, it is explicit and recorded in the audit log rather than being an invisible capability. We don't claim that no employee can ever access data — honest security means describing the controls, not making absolute promises.
Is my GST data protected?
Yes. GST returns, invoices, accounting records and related business information are handled within the same protected application environment and access-control framework as the rest of your data — the same encryption in transit, tenant isolation, permissions and audit trail apply to all of it.
Is payroll and employee information protected?
Yes. Payroll and employee-related information is protected through authentication, role-based authorization and access controls. Sensitive items such as confidential fee contracts are restricted to owner and manager roles, enforced by permission rather than convention.
Can I export my data?
Yes. Every return, register, ledger and report exports to Excel and PDF — GSTR-1, 3B and 9, sales, purchase and expense registers, debtors and creditors ledgers, Trial Balance, P&L and Balance Sheet — so your data stays portable, not locked in.
What happens to my data if I cancel or my subscription expires?
When a subscription or trial period ends, the account moves to read-only — you are not locked out, and it can be extended or converted to a paid plan. Your data stays available to view and export during that period. The exact data retention and deletion timeline is defined in our Privacy Policy and applicable service terms, and you can request deletion through our security contact.
Where is my data stored?
Your data is hosted on managed cloud infrastructure, with data kept in India, in a managed PostgreSQL database that has row-level isolation per company and managed backup and recovery procedures.
Is my data backed up?
Business data is held in a managed database with backup and recovery procedures intended to help protect against accidental loss and infrastructure failures. We describe this as a procedure, not a guarantee of zero data loss or instant recovery.
Demo book कीजिए — बिल्कुल freeSee your business
See your business
running on Finkitaabh.
A 30-minute personalised walkthrough with our product specialist — in Hindi or English, whatever you're comfortable with. We'll set up a sample company that looks like your business.
- 30-minute live walkthrough
- हिंदी या English में
- No payment, no obligation