Security Policy

DRAFT for legal review. This text was prepared as a starting point and is not yet in force. Replace the items in [square brackets] and remove this line before publishing.

Your filings involve identity, financial and business documents. This page explains, in plain terms, how Tsquare Professionals protects them and what we ask of you. It forms part of our Terms & Conditions and should be read with our Privacy Notice.

1. How we protect your documents

• Encrypted at rest. Documents you upload, and the drafts and acknowledgements we upload for you, are stored encrypted (AES-128 with an HMAC integrity check) in a private folder that the web server cannot serve directly.
• Encrypted in transit. The whole site is served over HTTPS only, and browsers are told to always use HTTPS for it.
• Access on a need-to-know basis. You can see only your own filings. Only the executive assigned to your filing and our managers can open your documents. Every document download by our staff is logged.
• Identity numbers are masked. Our staff see your Aadhaar number masked (only the last four digits) and must take a logged, deliberate step to see it in full when a filing needs it.
• Audit trail. Sign-ins, failed sign-in attempts, every action on a filing, payments and document downloads are recorded with the time and the person responsible.
• Limited retention. We delete documents after the retention period described in our Privacy Notice, and warn you before we do.

2. Payments

Online payments are processed by our payment gateway, Razorpay. Your card, UPI and bank details are entered on Razorpay's secure checkout and never reach our servers. We confirm each payment using Razorpay's cryptographic signature before we mark it as paid.

3. Your account

• Use a strong password that you do not use anywhere else, and keep it private.
• We verify your email address before you can sign in. Repeated failed sign-in attempts are temporarily blocked.
• We will never ask for your password, OTPs or bank PIN by phone, email or WhatsApp. If someone does, do not share them and tell us.
• Upload only genuine documents, and only the ones the service asks for.
• Sign out when you use a shared or public computer.

4. If something goes wrong

If we become aware of a security incident affecting your personal data, we will act to contain it, report it to CERT-In within the time the law requires, and inform the Data Protection Board of India and the affected clients as required by the Digital Personal Data Protection Act, 2023 and its Rules, explaining what happened, what data was involved and what you can do.

5. Reporting a security issue

If you believe you have found a security weakness on this website, or suspect someone has accessed your account, please email our Grievance Officer at [email protected] with "Security" in the subject line. Please give us a reasonable time to fix a reported issue before disclosing it, and do not access, change or delete data that is not yours while testing.

6. Changes to this policy

We may update this policy as our safeguards change. The date at the top of this page shows when it was last updated.