What we protect
Across our products we handle sensitive financial data: books of account, bank and card statements, invoices and bills, GST and income tax returns, notices, investment portfolios, payroll and KYC documents. Protecting it is the foundation of everything we build.
Where your data is stored
Customer data is stored in data centres located in India. Our websites and applications are hosted with Hostinger, and our application databases and file storage run on Supabase in an Indian region.
Some services we rely on process limited data outside India, for example the AI model that reads a bill or drafts a notice reply. In those cases we send only the content needed for the task, over encrypted connections, to providers whose terms do not allow them to use it to train their models. The full list is under Service providers below.
Encryption
In transit
- HTTPS on every VittSphere domain and sub-domain, with TLS 1.2 as the minimum
- HTTP Strict Transport Security (HSTS) and certificates from trusted authorities
At rest
- Databases and file storage encrypted at rest (AES-256)
- Passwords stored only as salted one-way hashes, never in plain text
- Uploaded documents kept in private storage, opened only through authenticated, time-limited links, and never indexed by search engines
Who can see your data
| Product | Access model |
|---|---|
| Accounting | Users and roles set by your organisation's owner. Your CA or auditor sees your books only if you invite them, with the access you choose. |
| Practice | Firm Admin sees all of the firm's clients; Managers and Staff see only clients assigned to them. Clients see only their own documents, invoices and status in the client portal. |
| ONE | Only you, and family members you add to your family profile. |
| Notice apps | You, and the reviewing Chartered Accountant for your case. CA firms using the same login as Practice follow the firm's role rules. |
| Recover / Diagnostic | You, and the Chartered Accountant who verifies your claim or reviews your report. |
- Every organisation's data is logically separated from every other's.
- VittSphere staff access production data only to resolve a support request or a security issue, under multi-factor authentication, and access is logged.
- We never give advertisers, data brokers or other third parties access to your data.
Payments and passwords
- Subscription payments are processed by Razorpay. We never see or store your card, UPI PIN or net banking details.
- We never ask for your net banking password. Where a product prepares a vendor or salary payment, you complete it yourself on your bank's own page.
- Nothing is filed on a government portal, paid or sent to a third party without your approval.
Service providers
We use a small number of trusted providers to run our products. Each receives only the data it needs.
| Provider | Purpose |
|---|---|
| Hostinger | Website and application hosting, business email |
| Supabase | Application database, authentication and file storage (India region) |
| Razorpay | Subscription and per-notice payments |
| Interakt | WhatsApp messages: sign-in codes, reminders and updates |
| Anthropic | AI processing to read documents and draft replies (data not used for model training) |
| Sandbox (Quicko) | GST and income tax data APIs, when you or your CA connect a portal |
| Marketplaces and apps you connect | Amazon, Flipkart, Google Drive, Tally or Zoho Books imports, only when you connect them |
Retention and deletion
- After you cancel, your data stays available for export for 30 days.
- It is then deleted from active systems within 90 days of cancellation, and from backups as they expire, unless the law requires us to keep a record (for example, our own GST invoices to you).
- You can ask for earlier deletion at any time from Settings, where available, or by writing to privacy@vittsphere.com.
Digital Personal Data Protection Act 2023
Our products are designed in line with the DPDP Act 2023 and the rules made under it:
- Clear notice and consent before we collect personal data
- Data used only for the purpose you gave it for
- Your rights to access, correct, export and erase your data, and to nominate someone to act for you
- Notification to affected users and to the Data Protection Board of India if a personal data breach occurs
- A grievance contact: privacy@vittsphere.com, with a response within the period the law requires
Professional confidentiality
Where a product includes review by a Chartered Accountant (notice replies, ITR filing, Recover claims, diagnostic reports), the reviewing CA is bound by the confidentiality requirements of the ICAI Code of Ethics and the Chartered Accountants Act, 1949, in addition to our own obligations to you.
What we do not do
- We do not sell your data.
- We do not use your financial data to train AI models.
- We do not show you advertising based on your financial data.
- We do not use your data for anything beyond providing the service you signed up for.
Responsible disclosure
If you find a security vulnerability in any VittSphere product, please report it to security@vittsphere.com before disclosing it publicly. We acknowledge reports within 48 hours and keep you updated until it is fixed. Please do not access other users' data, disrupt our services or run automated scans that degrade them.
Contact
Security: security@vittsphere.com
Privacy and data requests: privacy@vittsphere.com
VittSphere Technologies Private Limited · Undri, Pune, Maharashtra 411060