Security

What we hold, what we never see, in plain statements.

Stays in your browser

Marketplace reportsAmazon, Flipkart, Meesho and Myntra exports are opened and read in the page. Our server has never held one.

Your registers and Tally filesExcel, CSV and Day Book exports are read the same way.

Your GSTR-2B and TCS statementHeld against your books in the page, then discarded with the tab.

Bank statements and Form 26ASExcel, CSV and PDF statements, and TRACES’ 26AS, are read the same way. A PDF locked with a password is not opened. What reaches us from them: an account’s last four digits and closing balance, the entries waiting in Suspense, and each marketplace’s monthly TDS figure.

A notice’s PDFOpened beside the notice register for as long as the page is open. It is never sent; only the fields you type are kept.

The free toolsEverything you type or drop into them stays on your device.

Reaches our server

Your accountName, email, business name, and a password stored only as a bcrypt hash.

Your GSTINsThe registrations you add, and which staff may see each.

Each return’s totalsFigures, counts and sources for every prepared month, so history has an answer; for a settlement month or a GSTR-9 year you keep, its totals and differences, never an order or an invoice.

A bill you choose to have readSent through our server to Anthropic’s Claude API, or Google’s Gemini API when Claude cannot answer, once you have agreed in writing. No copy of the image is kept.

A month a client sends a firmThrough an upload link: the prepared return, its checks, the client’s note and each file’s fingerprint. Never the file.

What you type or confirm hereAmendments on a return, Tally ledger names, product codes, buyers confirmed on a bill, a marketplace’s rate card, GSTR-9’s Tables 15, 16 and 18, a notice’s fields. A notice’s notes and reply and a supplier’s email and phone are kept encrypted. The privacy policy lists every item.

From a bank statementThe account’s last four digits and the closing balance its last vouchers file ran to, the rules you make, and an entry’s date, amount and narration while it waits in Suspense.

Portal access, if you switch it onNot offered yet. Once it is, for one registration: the consent and the portal username, encrypted, and the portal’s session token and key, encrypted, until access ends, with a log of each call without its contents. What is read is passed to your browser and not kept.

An assistant, if you connect oneClaude, ChatGPT or another: the connection and what you allowed it, when it was last used, its tokens only as keyed hashes, and a log of each call without its words or answers.

No portal password, ever

There is no field for your GST portal password and no route that takes one. By default fynxIQ does not touch the portal: you upload the JSON and file there yourself. Portal access through a GST Suvidha Provider is built and not offered yet. Once it is, it is switched on one registration at a time, with the taxpayer’s own OTP, used once and never stored. It only reads, what it reads goes to your browser and is not kept, and Revoke deletes its session at once.

Two-step sign-in

Six digits from an authenticator app, or one of ten single-use recovery codes. Required of every practice owner before the firm board opens and of anyone who connects an assistant, and offered to everyone else in Settings. A new password is checked against known breaches before it is accepted.

Sessions you can see and end

Settings lists every browser signed in as you, with its address and when it was last used. End any one of them, or every one but this, in one click. Changing your password signs out every other one and disconnects every assistant you connected.

Rules decide; a model only explains

Whether a return can be filed is decided by fixed rules. The Ask box answers from your return’s own figures when you ask, and cannot clear a blocker or change a figure. Nor can an assistant you connect.

Assistants you connect read summaries

You can connect Claude, ChatGPT or another assistant to your own fynxIQ login, approving it on fynxIQ’s page, signed in here, so it never sees your password. It reads where the clients you can see stand, never a file, and does only the actions you tick: mark a period filed, make an upload link, send the reminder. Each call is logged without its words. What it reads goes to that assistant’s company under your account with them. Revoke it in Settings and it stops at once.

Secrets under a key of their own

A supplier’s email and phone, a notice’s notes and reply, your two-factor secret and portal access’s username and session are each sealed with a key of their own (AES-256-GCM), under a master key used for nothing else. When that key is changed, each is sealed again under the new one, and a contact or a notice still under a key no longer held is never written over. E-invoice and e-way bill credentials, if fynxIQ comes to take them, will be kept the same way, and the client can remove them.

Card details never touch our servers

Cards are entered in Razorpay’s own window. We keep the plan, the amount and Razorpay’s reference, and a plan starts only when Razorpay’s signed confirmation reaches us.

Deleting your data

From Settings, the owner takes everything out as one zip, then deletes the organisation. It is hidden at once and purged after seven days, and until then the owner can restore it. Payment records are kept, as the law requires.

Found something? Tell us first.

Write to official@fynxiq.com with “Security” in the subject. A person replies within one working day.