Security at GSTPaid
GST data is business data. Here is what GSTPaid does to protect it, and what it deliberately does not collect.
We never ask for your GST portal login
GSTPaid does not connect to the GST portal. We do not collect your GST portal username or password. To check supplier ITC risk you upload the GSTR-2B file that you download yourself.
Each account sees only its own data
Access rules are enforced in the database itself, not just in the app. Your GSTINs, notices and alerts are readable only by your account (and by a CA you have explicitly linked, for that CA's own clients).
Role-based access
Business owners, CA firms and administrators each get a separate set of screens and permissions. Admin pages cannot be opened by other roles, even by typing the address.
Secure sign-in
Accounts are protected by email and password sign-in. Passwords are handled by a dedicated authentication service and are never stored in readable form.
Payments handled by Razorpay
Subscription payments are processed by Razorpay. Your card or UPI details go to Razorpay and are never seen or stored by GSTPaid. Payment confirmations from Razorpay are checked with a cryptographic signature before they change your plan.
AI assistant requires sign-in
The AI assistant and notice explainer can only be used by signed-in accounts, and usage is limited per plan so the service stays reliable and cannot be abused.
What this page does not claim
GSTPaid is a young product. We do not currently hold third-party security certifications such as ISO 27001 or SOC 2, and we do not promise any. What is described above is what the product does today.
Found a security problem? Please tell us through the contact details on our Contact page before sharing it publicly, so we can fix it quickly.
Never miss a GST deadline again
Due-date calendar, AI notice help in Hindi and English, and a CA portal. 14-day free trial, no credit card needed.
Start free trial