Security and trust
Your Clients’ Data, Walled Off by the Database Itself
Firms trust us with returns, books and credentials for every client they serve. This page explains in plain words what protects that data, what our own staff can and cannot see, and which claims we are still confirming.
Audit trail · Kaveri Looms
Append-only- 30 Oct 17:05
Ananya Patil
Locked period · Sep 2026
- 30 Oct 16:58
Rohan Mehta
Reversed journal · JV-2026-0930-14
- 20 Oct 15:46
Ananya Patil
Filed return · GSTR-3B · Sep
- 12 Oct 11:20
Support (session S-118)
Viewed, read-only · Tally import log
Corrections are new entries. Nothing here is edited or deleted.
01 · The six controls
Folio 01 of 05
What Protects a Firm’s Data
Each control in one line, then how it works. Anything still being confirmed carries a tag until it is confirmed.
Data residency
Your firm’s data, documents and AI processing stay in AWS Mumbai (ap-south-1).
India workspaces are hosted in the AWS Mumbai region, including document storage and the AI models Veda calls.
Placeholder · to confirmOne firm cannot see another
The database itself walls off each firm’s rows. A bug in a screen cannot show you a stranger’s client.
Every firm’s rows carry its firm ID, and the database refuses to return a row unless the request runs as that firm. The check sits below the application, so a mistake in a screen cannot widen it.
An audit trail nobody can edit
Every change records who, when, before and after. Posted journals are reversed, never deleted (Rule 3(1)).
Every change to a financial or master record writes who, when, what changed and why, in the same transaction as the change. The log accepts new rows only.
Placeholder · to confirmDPDP readiness
Consent records, data-subject requests and erasure that keeps the financial record intact.
Consent is recorded per purpose, data-subject requests are tracked to closure, and erasure replaces personal details while keeping the financial record intact.
Placeholder · to confirmSSO and SAML
Sign in through your identity provider on Enterprise, with passkeys and 2FA for everyone.
Enterprise workspaces sign in through SAML or OIDC. Everyone else uses passkeys or a password with a second factor, and sessions can be ended from one screen.
Support only with your consent
Our team sees your data only in a time-boxed session your firm approves, and you can watch it.
Our staff can open a firm’s data only in a support session the firm approves, limited in time and read-only by default, and the firm sees every screen opened.
02 · Tenant isolation
Folio 02 of 05
One Firm Cannot See Another
Isolation is enforced where the data lives, so it holds even if a screen or a report has a bug.
1Request
Rohan Mehta opens Kaveri Looms
The request carries who is asking and which firm they belong to, checked against their session.
2Firm context
The firm is set for this transaction only
Before any query runs, the database session is told which firm is asking. Nothing outside it can be selected.
3Database policy
Rows from other firms never return
Row-level policies on every firm table compare each row’s firm with the request’s firm, and are forced for the application role.
Every new firm table ships with a test that tries to read another firm’s rows and must fail. Search, documents and the vectors behind Veda are filtered by firm inside the query itself.
03 · AI governance
Folio 03 of 05
Veda Proposes. People Decide.
Veda never posts, files, sends or pays. Every result is a proposal that waits for a person with the right role.
Approval by role
Who may approve a journal, a filing or a message is set by roles and checked by the API on every request.
Sources on every answer
Each proposal lists the documents and records it relied on, so a reviewer can check them.
Corrections leave a trail
An approved entry that turns out wrong is reversed with a reason, and the original stays on record.
Usage you can see
AI work is metered in credits per task, with notices at 80% and 100% of the allowance.
Accrue the October audit fee
Kaveri Looms Pvt Ltd · Based on 2 sources
- 1The engagement letter bills ₹45,000 per quarter and nothing is booked for October yet.
- 2Last year the same entry was posted on 31 Oct.
- 3Without it the month shows expenses lower than they are.
| Account | Dr | Cr |
|---|---|---|
| Audit fees | ₹45,000.00 | |
| Provision for expenses | ₹45,000.00 |
04 · Access and accounts
Folio 04 of 05
Every Sign-In Is Someone You Know
Strong sign-in for everyone, your identity provider for Enterprise, and a clear answer to who can see what.
Workspace security
- Enforced
Single sign-on
SAML · your identity provider
- Required
Second factor
Passkey or authenticator app
- On
IP allow-list
3 office networks
- Edited 2 Oct
Custom roles
7 roles across 24 entities
- None active
Support access
Only in sessions you approve
Passkeys and second factors
Passkeys, authenticator apps and recovery codes, with new-device emails.
SSO and IP allow-list
SAML or OIDC on Enterprise, and sign-in only from networks you name.
Roles and maker-checker
Custom roles, entity scopes, and a second approver on filings.
Support with consent
Time-boxed, read-only sessions that your firm approves and can watch.
05 · Data protection
Folio 05 of 05
What We Keep, and How
The rules the code follows for sensitive data, and the infrastructure claims we are still confirming.
Portal credentials are encrypted
GST, income tax, MCA and bank portal credentials are encrypted with per-record keys, and every decryption is permission-checked and logged.
No Aadhaar numbers stored
Only the last four digits and a reference token are kept. Card numbers and CVVs are never stored.
Uploads checked before use
Every file is checked for type and size and held back until it is cleared, before anyone opens it.
Personal data kept out of logs
Logs pass through a redaction list, so names, emails, PANs and secrets never reach them.
Encryption at rest and in transit
Databases, backups and document storage are encrypted with managed keys, and traffic uses TLS.
Placeholder · to confirmBackups and recovery drills
Point-in-time database backups with recovery drills recorded against a target.
Placeholder · to confirm
Certifications
Shown here only once each one is held, with its scope and date.
Placeholder · to confirmReporting a vulnerability
A dedicated security contact and disclosure policy will be listed here. Until then, use the contact form and choose “Privacy or security”.
Contact usSub-processors and the DPA
The data processing agreement and the list of sub-processors are being prepared with legal review.
Data processing agreementQuestions
Questions Security Teams Ask
Send your questionnaire with the demo request and we answer it line by line.
Can one firm ever see another firm’s data?
Each firm’s rows are separated inside the database itself, so no screen decides who sees what. Every request runs with your firm’s identity, so a query cannot return another firm’s clients.
Can OneTrails staff read our data?
Only in a support session your firm approves. It is time-limited, read-only unless you allow more, and every screen opened is recorded where your firm can see it.
Does Veda send anything to a client or a portal on its own?
No. Veda prepares proposals. A person with the right role approves before anything is posted, filed, sent or paid.
Where is our data stored?
India workspaces are hosted in AWS Mumbai (ap-south-1), including documents and AI processing.
Placeholder · to confirmWhich certifications do you hold?
We list a certification only once it is held. This page will show each one with its scope and date.
Placeholder · to confirm
Security review
Bring Your Security Questions to the Demo.
We walk your IT or risk team through isolation, access, audit and AI controls with the product open, and answer your questionnaire.