Security at 24eTax

Your invoices, books and GST data are the record of your livelihood. This page explains — in plain language — how 24eTax protects them. No jargon, no exaggerated badges.

Encryption, at rest and in transit

The database on your phone is encrypted (SQLCipher) with keys held in your device's secure hardware (Android Keystore / iOS Keychain) — a stolen phone does not mean stolen books. Every connection to our servers uses TLS, and the app additionally pins our server's certificate, so a fraudulent network cannot impersonate us.

Sign-in and account protection

Sign-in is by OTP to your mobile number, or email and password, with optional two-factor authentication (TOTP). Repeated failed attempts lock the login temporarily. Sessions can be revoked from every device at once, and stolen tokens die when you sign out everywhere.

Access control inside your business

Staff get roles — salesman, accountant, admin — and each role sees only what it should. Permissions can be fine-tuned per person. Every financial change is written to an append-only audit log: who, what, when.

Your books can't be silently rewritten

Committed documents are immutable. Corrections happen through cancellations and amendments that leave the original visible — exactly what an audit or assessment expects. Underneath, real double-entry postings must balance; the database itself enforces it.

Isolation between businesses

Every record is tied to your business, and the database enforces row-level isolation — one company's data cannot leak into another's queries, even by programming mistake.

GST portal operations

Connections to GSTN run through a Government-licensed GST Suvidha Provider. OTPs you enter are used once and never stored. Every payload sent to or received from GSTN on your behalf is kept in an encrypted archive — your protection in any dispute about what was filed and when.

Backups and recovery

Server data is continuously backed up with point-in-time recovery, and our restore procedure is documented and rehearsed. Your offline device keeps working even during a server outage.

Your rights over your data (DPDP Act, 2023)

Consent is asked at the moment of collection, with the purpose stated plainly. You can export your complete personal data, correct it, or erase your account from inside the app — financial records are retained for the statutory 8 years with personal identifiers removed where the law permits. Details in the privacy policy.

What we deliberately do not claim

We do not display certification logos we have not earned. As independent audits and certifications are completed, they will be listed here — until then, the honest description above is what you should judge us on.

Questions about security, or something to report? Write to support@24etax.com — security reports are read first.