Your data in SignReady

Is it safe to keep client data on the cloud?

Your clients' data is already on the cloud: the Income Tax, GST and MCA portals are all online. Software CAs use every day has moved too: KDK Spectrum Cloud (ITR, TDS, GST), ClearTax, Zoho Books, Tally on AWS, and the Big Four audit tools KPMG Clara and EY Canvas.

A laptop can be lost, stolen or hit by ransomware, and with it the only copy of your working. On SignReady your data is safe even if the laptop is not.

Where is my data kept?

On Amazon Web Services (AWS) servers in Mumbai, India. Workings you attach are stored in AWS storage in the Mumbai region, encrypted. Your data does not leave India for storage.

How is it protected?

• All traffic is encrypted (HTTPS), and reaches us through Cloudflare, which filters attacks.
• Passwords are stored only as one-way hashes: nobody, including us, can read them. Repeated wrong attempts are limited.
• Uploaded files get random names in storage the internet cannot reach. They open only through SignReady, after a check of who is asking, on every request.

Who can see my clients' files?

• Partners of your firm: all your finalisations.
• Staff: all files or only the finalisations you add them to, as you decide.
• Client's people you invite: only that one finalisation, never your materiality, review points or working papers.
• PracticeGuru support: only when you raise a support issue about that file, and every such access is recorded.

Is my data sent to AI or sold?

Not sold, and never used to train AI. Client files are not sent to AI services, with one exception: when a trial balance does not import, SignReady's AI help (Anthropic's Claude) reads its headings and a sample of rows — title rows, party names, PAN, GSTIN and contact details removed — to explain what is wrong. We do not sell data and do not use it for advertising.

What if something goes wrong on the server?

The database and files are backed up every night.

Can I delete my data?

Yes, at any time: a single file, a whole finalisation, or all your firm's client data (Partners, from Subscription & data). One exception: certificates you have signed (with their evidence and history) are kept unchanged for 7 years from issue, as ICAI's Guidance Note expects for assurance documentation; drafts are deleted.

If your plan ends and is not renewed, your data stays view-only for 90 days and is deleted 180 days after the end. We email Partners 30, 7 and 1 days before deletion.

What about the DPDP Act?

For your clients' data your firm decides the purpose and SignReady processes it only on your instructions, as set out in our Data Processing Addendum. See also the Privacy Policy and Data retention policy. Questions or requests go to our grievance officer, Sachin Mohite, at [email protected].