Security model

Built for data you can't afford to leak

GSTPilot handles turnover, invoice values and GSTINs. Here is exactly how that data is treated.

Encrypted in transit

Every upload and API request travels over HTTPS using modern TLS 1.3. Nothing about your sales data crosses the wire in the clear.

Isolated processing

Uploaded workbooks are parsed in isolated worker sessions scoped to your request, so one account's files are never in reach of another's.

Never sold, never shared

Your sales figures are used for exactly one thing — producing your return. They are not sold, brokered or shared with third parties.

Least-privilege access

Administrative roles are read from the database on every request rather than trusted from a session, so revoking access takes effect immediately.

Audited changes

Pricing, wallet and credit adjustments are written to an audit log recording which administrator made each change.

Minimal retention

We keep the metadata needed to show your filing history. Raw uploads are not retained beyond the processing they were provided for.

Responsible disclosure

If you believe you have found a vulnerability, please report it privately before disclosing it publicly. We will acknowledge your report and keep you updated while we investigate.

Report a security issue