Security

You upload PAN numbers, salary slips, and Aadhaar details to Arth. That is sensitive information, and we treat it accordingly. This page describes what we do to keep it safe.

Encryption in transit

Every connection to Arth uses HTTPS (TLS 1.2+). Your documents and data are encrypted the entire way from your browser to our servers. There is no unencrypted HTTP access — all requests are redirected to HTTPS.

Data storage

Your data is stored on Microsoft Azure infrastructure. The database is not directly accessible from the internet — it sits behind the application server, which handles authentication and authorization before any data is read or written.

Uploaded PDFs and filing data are stored per-user. There is no shared data store where one user's data could leak into another user's view.

Access control

Your filing data is tied to your authenticated session. The application enforces that you can only read and write your own data — every API request is checked against your user ID.

Server access is restricted to the founding team via SSH key authentication. There is no shared password, no admin panel exposed to the internet.

AI assistant and your data

When you use the AI assistant, your filing context is sent to an LLM to generate responses. This is how the assistant knows about your salary, deductions, and documents — it reads the relevant sections of your filing to answer your questions.

We do not allow model providers to retain or train on your data. Conversations are processed and discarded by the model provider — they are not stored on their end for future training.

What we do not do

• We do not sell, rent, or share your financial data with any third party
• We do not use your data for advertising or profiling
• We do not use your data to train AI models
• We do not store your payment credentials — Razorpay handles payments directly
• We do not access your Google account beyond what is needed for sign-in (name, email, picture)

Data deletion

You can request deletion of your account and all associated data at any time by emailing contact@askarth.com. We will delete everything — your account, filings, uploaded documents, and chat history — within 30 days.

Found a vulnerability?

If you discover a security issue, please report it to contact@askarth.com. We take all reports seriously and will respond within 48 hours.