We never ask for GST portal credentials
You download GSTR-2B, 2A or GSTR-1 yourself and upload the file. Nothing in Parakh can log in to the GST portal as you.
Your books are confidential. We treat them that way.
Parakh holds purchase registers and supplier details for businesses and their CAs. Here is exactly how that data is protected, kept and deleted.
Encrypted in transit and at rest
TLS 1.2+ with HSTS on every connection. The database and backups sit on encrypted disks.
Every row belongs to one workspace
Every query is scoped to your workspace, and automated tests check that one workspace can never read another's runs, uploads or exports.
Strong sign-in
Argon2id password hashing, optional TOTP two-factor, rate-limited sign-in, server-side sessions you can revoke, and all sessions signed out on a password reset.
Least privilege by role
Owner, admin, member and viewer roles. API keys act with their creator's role and can be revoked instantly. Every change lands in the audit log.
Kept only as long as needed
Uploaded files are deleted after 7 days. You choose how long reconciliations are kept. Email logs go after 30 days, and IP addresses in the audit log after 180.
Digital Personal Data Protection Act, 2023
For your account data (your name, email and sign-in activity), Parakh Software is the data fiduciary. For the personal data inside your registers and supplier contacts, you are the data fiduciary and Parakh acts as your data processor under our data processing addendum.
- Notice and consent: an itemised notice at sign-up, consent recorded with a timestamp and notice version, and a fresh request whenever the notice changes materially.
- Your rights, self-serve: download all your data, correct your profile, withdraw marketing consent, nominate someone, or erase your account from Settings → Privacy & data.
- Grievance redressal: a named Grievance Officer, acknowledgement on receipt, a response within 7 days and resolution within 30.
- Breach notification: if a personal data breach happens we will inform affected users and the Data Protection Board of India without delay, as the Act and its Rules require.
- No selling, no ads, no trackers. We set one strictly necessary session cookie. There is no analytics or advertising code on any page.
- Data stays in India: production data is hosted in Indian data centres.
Application security
- Content Security Policy, frame blocking, CSRF protection (origin check plus a required request header) and SameSite cookies.
- Spreadsheet exports neutralise formula injection, and uploads are size-capped and parsed on the server, never executed.
- Payments are processed by Razorpay. Card and UPI details never reach our servers, and payment confirmations are signature-verified and idempotent.
- Dependencies are kept to a minimum: a single Go binary, a PostgreSQL database, and no third-party scripts in the app.
Report a vulnerability
Email support@parakh.in with the subject "Security". We reply within two working days and won't take action against good-faith research.