Information Security

Jump to a section

In short
Governance
Encryption
Access control
Government portal credentials
Payment security
Infrastructure and operations
Vendors and processors
Incident response and breach notification
Retention and secure disposal
What we ask of you
Fraud and impersonation
Reporting a vulnerability
Limitations
Security contact

01In short

You trust us with PAN, Aadhaar, bank details, income records and government portal credentials. This page sets out the technical and organisational measures Starkbros Consultancy Private Limited applies to protect that information, in line with the "reasonable security safeguards" expected under the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and the Information Technology Act, 2000 framework.

02Governance

A named officer is accountable for information security and data protection, and is the point of contact for security matters.
Security responsibilities are defined for employees and contractors, and confidentiality obligations are written into their engagement terms.
We review this Policy and our controls periodically, and after any significant incident or change in our systems.

03Encryption

All traffic between your browser or app and our servers is encrypted in transit using TLS.
Stored data, including uploaded documents, is encrypted at rest by our hosting provider.
Passwords are stored using one-way salted hashing. We cannot read your password, and no member of our team will ever ask you for it.

04Access control

Access to customer data follows the principle of least privilege — team members can reach only the data required for the work assigned to them.
Administrative access is restricted to authorised personnel and protected by multi-factor authentication.
Access is logged, reviewed periodically, and revoked promptly when a person changes role or leaves.

05Government portal credentials

Handled with particular care

Where you provide credentials for the Income Tax portal, GSTN, TRACES or MCA so that we can file on your behalf, those credentials are stored in encrypted form, used only to deliver the Services you requested, and never shared outside the team and professionals engaged on your work.

We recommend that you change portal passwords after an engagement ends, and we will delete stored credentials on request.

06Payment security

Payments are processed by RBI-authorised, PCI-DSS compliant payment gateway partners. Card numbers, CVV, UPI PINs and net-banking credentials are entered directly with the gateway. We never see or store them.

07Infrastructure and operations

Our systems are hosted with reputable cloud providers operating certified data centres, with data primarily located in India.
We apply network controls, firewalls and monitoring to detect unusual activity.
Security patches and dependency updates are applied on a regular cycle.
Backups are taken regularly and stored securely to support recovery.
Logs are retained to support investigation, and are protected against tampering.

08Vendors and processors

Where a third party processes personal data on our behalf — hosting, communication, analytics or support — we engage them under a written contract that requires confidentiality, appropriate security measures, and processing only on our instructions. We assess vendors before onboarding them.

09Incident response and breach notification

We maintain a documented process to detect, investigate, contain and remediate security incidents.
If a personal data breach occurs, we notify affected Data Principals and the Data Protection Board of India in the manner and within the timelines required under the DPDP Rules, 2025.
Notifications describe the nature of the breach, its likely consequences, the measures taken, and steps you can take to protect yourself.

10Retention and secure disposal

We keep data only as long as necessary or as the law requires, and delete or anonymise it thereafter. Statutory records under the Income-tax Act, 1961, the GST laws and the Companies Act, 2013 are retained for the periods those laws prescribe. Disposal is carried out so that data cannot be reconstructed.

11What we ask of you

Security is shared. You can materially reduce risk by:

Using a strong, unique password for your efiletax account and never reusing it elsewhere.
Enabling multi-factor authentication where we offer it.
Never sharing OTPs, passwords or portal credentials over phone, chat or email with anyone claiming to be from efiletax — we will never ask for them.
Accessing the Platform only through the official domain and keeping your device and browser updated.
Telling us immediately if you suspect unauthorised access to your account.

12Fraud and impersonation

Beware of impersonation

We communicate only from addresses ending in @efiletax.in. We never ask for your password, OTP, card CVV or UPI PIN, and we never demand payment to a personal bank account or UPI ID. If you receive such a request, do not act on it — report it to security@efiletax.in immediately.

13Reporting a vulnerability

If you believe you have found a security vulnerability in our Platform, tell us at security@efiletax.in with enough detail to reproduce it. We ask that you give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly, and that you avoid accessing, modifying or deleting data belonging to other users while testing.

We acknowledge reports and keep you informed as we work on a fix. We will not pursue action against researchers who report in good faith and follow these guidelines.

14Limitations

No system is completely secure. While we apply safeguards appropriate to the sensitivity of the data we handle, we cannot guarantee absolute security, particularly against events outside our reasonable control or arising from compromise of your own device or credentials.

15Security contact

Security reports: security@efiletax.in
Data protection: support@efiletax.in
Address: 1227, Kambar Colony, 18th Main RoadAnna Nagar West, ChennaiTamil Nadu 600040, India