Security

Encryption

• In transit: every connection to IntegralChase uses HTTPS (TLS), including uploads and downloads.
• At rest: our database and file storage are encrypted at rest by our infrastructure provider.

Private file storage

• Uploaded documents are stored privately. There are no public links to any file.
• Downloads use private links that expire within minutes (60 seconds for a single file, 5 minutes for “Download all”).
• Clients can upload files to their own request, but can't view or download what they uploaded. The only files a client can download are ones your firm has chosen to share with them, from their own private portal link, using the same short-lived download links.
• Deleting a request or a client permanently deletes their uploaded files from storage.

Client upload links

• Each request gets its own secret link with 192 bits of randomness, so it can't be guessed or worked out from another link.
• A link only gives access to that one request's checklist. It never gives access to your account.
• Upload pages are hidden from search engines and don't pass the link on to other websites.
• If a link is shared by mistake, you can create a new one in one click. The old link stops working immediately.

Account separation

Each firm's data is separated by access rules enforced inside the database itself (row-level security), not only by our application code. These rules are designed so that one firm can't read another firm's clients, requests or files.

Uploads

• Only PDFs, photos and spreadsheets are accepted, up to 50 MB per file.
• Automatic checks (wrong financial year, someone else's PAN, missing months of a bank statement, password-locked or damaged files, blurry photos) run on our own servers. Documents are not sent to any AI service.

Sign-in and access

• Passwords are stored as secure hashes by our authentication provider; we never see them.
• You can sign in with Google instead of a password.
• Service keys are kept on our servers only and are never sent to your browser.

What we never ask for

• No access to your WhatsApp. WhatsApp messages are sent from your own phone: we only open WhatsApp with the message ready, and you press send.
• No income tax or GST portal passwords, yours or your clients'.
• No app for your clients to install and no account for them to create. They upload through a private link.
• No selling of data, and no training AI on documents. Your clients' files are used only to run your firm's requests.

Passwords for locked PDFs

To open a password-protected file we try common patterns built from the client's details, or use a password the client or firm types. The password is used to open that file and is not saved in our database or alongside the file. We keep an unlocked copy of the file for the firm, stored privately like the firm's other documents.

Where your data is stored

Data and files are stored in Mumbai, India, encrypted in transit and at rest. See our privacy notice for the providers we use and how long we keep data.

Infrastructure

IntegralChase runs on Supabase (database, authentication and file storage) and Vercel (application hosting). Emails are sent through Resend. Each provider runs its own security program; see their security pages for details.

IntegralChase is an early-stage product and has not yet completed its own independent security audit (such as SOC 2). We'd rather tell you that plainly.

If something goes wrong

If a security breach affects your data, we investigate and contain it, tell the affected firms without undue delay and within 72 hours of confirming it, explain what happened, what was involved and what we are doing, and notify authorities where the law requires. In India that includes the Data Protection Board (without delay, with a detailed report within 72 hours) and CERT-In (certain incidents within 6 hours); we keep system logs for 180 days.

Reporting a problem

If you think you've found a security issue, please email support@integralchase.tech. We'll respond quickly and keep you updated.