What CLAVIS keeps, where, and why.

On the free trial

The trial computes and refuses to store a record. It holds no working copy between requests, so nothing you upload there outlives the page.

So that one visitor cannot use up the trial for everyone, requests are rate-limited per visitor — counted against an anonymised session or network address, never stored with anything you uploaded.

What a firm's workspace keeps

• Computations, as records. What was computed, under which rules and engine, and what was filed — never overwritten. A correction is a new record beside the old one, and a filed return is never replaced.
• The facts each computation used — the figures, not the person. This snapshot holds no name, PAN or date of birth; only whether the taxpayer is a senior or very senior citizen, which the law needs.
• A record of each document, not the document. An uploaded file is read and not kept. What stays is its SHA-256 fingerprint, its type and year, who uploaded it, and its file name with any PAN in it blanked out.
• A working copy, for at most eight hours. While you work on a return, the full profile read from the documents — the one record that does carry identity — is held for eight hours at most. After that CLAVIS will not open it, and it is deleted: by the next upload in your firm, or by the store's own expiry policy.
• Who did what. Saving a computation, marking a return filed, exporting one and assessing an erasure are each written to an audit log, so a firm can see who acted on which record.

Where it is kept

In Google Cloud's asia-south1 region, in Mumbai: the records in Firestore, and the servers that compute them on Cloud Run.

Google Cloud encrypts stored data at rest, and every page and request travels over HTTPS.

Who can see it

• Only your firm. Every record is filed under its firm in the storage path itself, so one firm cannot read another's clients — not by a filter someone could forget, but by where the record lives.
• Each person as themselves. People in a firm sign in with their own login, as an owner, a member or a viewer, so the record of who reviewed what stays true.
• A pseudonym, not the PAN. A client's records are filed under a salted pseudonym derived from their PAN, not under the PAN itself.
• Masked on screen. Screens show a PAN as ABCDE****F. The one place a full record leaves is the ITR-1 export, because the filing portal will not accept a masked PAN — and that export is written to the audit log when it happens.

Who else is involved

Nothing is sold, and no advertising or analytics runs on these pages. These are the services that do touch a visit:

• Scripts: none from anyone else. These pages' security policy lets a browser run scripts from this site only.
• The typefaces are ours. They are served from this site, so loading a page contacts no third party — not even for a font.
• Logto handles sign-in. It holds your sign-in identity — your email and login — not your tax records.
• Trial usage is measured. The free trial records which features ran and the figures computed, so we can see what works — with no name, PAN, email or network address attached, and never tied back to a person.
• The enquiry form stores nothing. A function in the same Mumbai region passes exactly the fields you filled in to our Zoho mailbox, and sends you a receipt that repeats none of it.
• Error reports, when switched on, have taxpayer data — request bodies, PANs, Aadhaar numbers, tokens — stripped before anything leaves.
• No AI model reads your documents or computes a figure. Documents are read by fixed rules, and every figure comes from the law written as data, computed twice.

How long, and how to have it removed

Saved records are kept while your firm uses CLAVIS. For any client, CLAVIS can state what it holds and what erasure would leave behind — naming any record a firm is required to keep rather than deleting it silently. Deletion on request is carried out by us today; a self-serve control is in build.

To ask what we hold about you, to have it corrected or to have it erased, write to us.