Data security
You are handing title deeds to a firm you have not met
If you are running an Indian property sale from six thousand miles away, this page matters more than any other on this site. Here is exactly how your documents are handled.
Most compliance work is done on documents that would cause real damage in the wrong hands: title chains, bank statements, tax identifiers, the papers proving who owns a house. We would rather set out how those are handled than describe our practices as careful and leave you to hope.
- One controlled channel
- Not WhatsApp, not personal email, not a memory stick.
- A register of what you lent us
- What arrived, when, and whether it was an original or a copy.
- Returned or deleted on request
- In days rather than weeks, subject only to what the law requires us to retain.
How documents move
Four rules, and no exceptions for convenience.
One controlled channel
Documents move through a controlled shared folder with access limited to the people working on your matter. Not over WhatsApp, not through anyone’s personal email, and not on a memory stick. If someone asks you to send papers another way, that is a mistake and we would like to hear about it.
A register of what you have lent us
We keep a list of every document you have given us, when it arrived, and whether it is an original or a copy. You can ask for that list at any time, and you should — it is the only way either of us can be sure nothing is sitting somewhere it should not be.
Returned or deleted on request
Ask, and your documents come back or are deleted, in days rather than weeks, subject only to what the law requires us to retain. No exit charge, no data held back, no reason needed.
Access limited to the matter
People working on your file can see your file. That is the whole rule. Nobody browses client folders because they are curious, and nobody is given access to a matter they are not working on.
The DPDP Act, and where we stand on it
India’s Digital Personal Data Protection Act, 2023 sets duties for anyone who processes personal data — consent, purpose limitation, security safeguards, deletion when the purpose is served, and answers when a data principal asks. Its obligations are still being phased in for firms of our size. We are not waiting for the phase-in: the four rules above are our adoption of the Act’s core duties now, and as the rules under the Act settle, this page will state plainly which obligations apply to us and how each is met.
What is shared, and with whom
Nothing leaves this firm unless you approved the filing it goes into.
Client information is disclosed only where a filing you have approved requires it — to the tax department, the GST portal, the Ministry of Corporate Affairs, or a similar authority — or where the law compels disclosure. We do not sell data, we do not share it for marketing, and we do not pass it to another professional firm.
If your matter needs a professional we cannot be, you appoint that person and you decide what to give them. We take no referral fee — and nobody outside this firm receives your papers because it suited us.
Your rights over what we hold
Ask, and you get an answer within two working days.
You may ask for a copy of what we hold about you, ask us to correct it, ask us to erase it, or withdraw a consent you have given. One email is enough — no form, no reason needed. The full position is set out in the privacy policy, which is written against the Digital Personal Data Protection Act, 2023.
Stated honestly
These are the controls we operate, described as they actually are. We hold no independent security certification, and we will not imply one before it is real. What we will do is answer any specific question about how your documents are handled, in writing, before you send us anything.
Ask before you send. Not after.
Any specific question about how your documents will be handled gets a written answer before you upload a single page.
Ask us