Security and Privacy

You hand us your PAN, your bank statements and your income for the year. That is a lot of trust, and this page explains, in concrete terms, what we do to deserve it. If you want the legal version, read the Privacy Policy. This page is the practical one.

Encryption everywhere

• Every connection to the site and the platform uses HTTPS with TLS 1.2 or higher. Plain HTTP requests are redirected.
• Documents are encrypted at rest with AES-256 in the storage layer. Database backups are encrypted as well.
• Encryption keys are managed by the cloud provider's key service and are never stored alongside the data or in application code.

Private document storage

Uploaded files go into private storage buckets with no public access. When your expert opens a document, the platform creates a signed link that expires within minutes and works only for that file and that session. There is no permanent URL to any document, so a leaked link is useless after it expires. Files are scanned for malware on upload.

Who can open your file

• Only the expert assigned to your order and platform administrators can view your documents.
• Other panel members cannot see your order, even by searching for your name or PAN.
• Every view, download and edit is written to an audit log with the user, the time and the file. You can request a copy of the log for your account.
• Staff and panel members sign confidentiality agreements and lose access the moment their engagement ends.
• Administrator access requires two-factor authentication.

Sensitive fields are masked

PAN and Aadhaar numbers are shown masked (for example, ABCPX****K) in every internal screen, list and notification. The full value is revealed only inside the filing form, only to the assigned expert, and that reveal is itself logged. Uploaded documents, their contents and identifiers are never written to application logs, error reports or analytics events.

Payments

Payments are processed by a PCI DSS Level 1 certified payment gateway. Your card number, CVV, UPI PIN or net banking credentials are entered on the gateway's page and never touch our servers. We receive only a payment reference, the amount and the status. Refunds are made through the same gateway back to the original payment method.

Where your data lives

The application, database and document storage are hosted in cloud data centres located in India. Analytics and messaging providers listed in the Privacy Policy receive only the minimum data needed to do their job, and none of them receive your uploaded documents.

Backups and availability

Encrypted backups are taken daily and kept for 30 days, so an accidental deletion or a failure on our side does not lose your filing history. Backups are stored in a separate India-region location from the live systems and are restore-tested every quarter.

If something goes wrong

We keep an incident response plan. If we discover or are told about a breach affecting your personal data, we contain it, assess what was affected, and notify you and the Data Protection Board of India as required under the DPDP Act, 2023. Our notice to you will say what happened, what data was involved, what we have done and what you should do, for example changing a password. We do not hide incidents to protect our reputation.

Report a security issue

If you find a vulnerability on this site or the platform, or you receive a suspicious message claiming to be from us, email sahiladvisory1@gmail.comwith the subject "Security report". We acknowledge within 48 hours, keep you informed while we fix it, and will not take action against good-faith researchers who report responsibly and do not access other people's data.

What we will never ask for

Fraudsters sometimes impersonate tax firms. Whatever the message says, Sahil Advisory will never ask for:

• Your income tax portal, GST portal or bank password over WhatsApp, SMS, email or a phone call. Credentials are entered only inside the secure form on the platform, for a task you have ordered.
• An OTP for anything other than a filing or e-verification you have approved. We tell you in advance which OTP we need and what it is for.
• Your card number, CVV, UPI PIN, net banking password or ATM PIN. Payments happen only on the gateway page, never in chat.
• Payment to a personal UPI ID or bank account. All fees are paid through the checkout link or the invoice with our registered details.
• Remote access to your phone or computer through screen-sharing apps.
• Any fee to release a refund from the Income Tax Department. Refunds are paid by the department directly to your bank account.

If you get a request like this, do not respond. Forward it to sahiladvisory1@gmail.com or call us on +91 78884 12302 to check. Our only official contact points are the number and email listed on this website.