Security and privacy
Not as a policy we promise to keep, but as an architecture that makes it awkward to break. Marketplace files are parsed in your own browser. The server that runs this site has never held one.
Every invoice line. Order and shipment references. Buyer names, delivery states and pincodes. Product titles and SKUs. The whole ledger, and every figure derived from it, for as long as the tab is open.
Your email, a password hash, your business name and plan. Which GSTINs you file for. Per return: the period, the totals, how many blockers and warnings there were, and which sources produced it.
The second column is deliberately the set of things a notice three years from now actually asks about. It is not the set of things a breach would make interesting.
The second opinion
The AI review runs on our own key, on our own server. You never bring a key and never see one. What it is given is a summary built by a single pure function.
The period, your state, table totals, the B2CS rows by state and rate, the HSN rows, document series ranges, and the findings the deterministic rules produced. Plus your own product titles, which are your catalogue, not anyone’s personal data.
No GSTIN at all, yours included. No buyer name, address or pincode. No order id, shipment id or ASIN. Diagnostic text is scrubbed on the way out, so a rule added next year cannot leak one by accident.
The projection is a pure function, and the engine’s test suite asserts that no excluded field can appear in its output. It is a passing test, not a marketing claim.
The app prints the exact bytes that would be sent and asks before sending them. Off by default, per return.
It cannot clear a blocker, cannot change a figure, and any amount it cites that is not already in your return is dropped before you see it. It is never asked whether the return is correct.
The account
Hashed with bcrypt at a work factor that costs an attacker real time. Sign-in takes the same time whether or not the email exists, so the form cannot be used to enumerate customers.
Signed tokens in an http-only, same-site cookie, secure in production, expiring in thirty days. No session data is readable by scripts on the page.
Card details are handled by the payment provider and never touch our servers. A plan is activated only by a signed webhook, never by the browser saying a payment succeeded.
Your files are read in your own browser. Invoice lines, customer states and order references never reach our servers. What we store is your account, your plan, and a record of the totals you prepared, which is what a notice three years from now actually asks about.
A summary of derived totals, HSN codes, your own product titles and the findings the rules produced. No GSTIN, no buyer, no address, no order reference. The app shows you the exact bytes before anything is sent, and asks first.
No. Deterministic rules decide whether a return can be filed. The model reads their findings back and points at things rules cannot express. It cannot clear a blocker, cannot change a figure, and is never allowed to report that a return is correct.
Something here look wrong to you? Tell us. We would rather fix it than argue about it.