Security note
Version 1 · 25 October 2026 · Nityaflow is run by Avartix, Telangana, India. Contact: hello@nityaflow.in
This note is for banks, payment companies, accounting firms and anyone who needs to know how Nityaflow handles data before using it. It says plainly what is in place and what is not yet.
1. What Nityaflow does, and never does
- Nityaflow runs checks (GST credit match, bank, TDS, PF and ESI, marketplace and UPI settlement), automation workflows and an assistant, and makes signed receipts of what was checked and approved.
- It never holds or moves money, and it never files or accepts anything on the GST portal. Payments are made by a licensed bank or payment app; filings by the user.
- It is not endorsed by, a partner of, or certified by NPCI, RBI or GSTN.
2. Where data lives
- Check files stay on the device. GSTR-2B, purchase registers, bank statements, settlement reports and the other check files are read in the browser. They are not uploaded. Only a summary and the receipt are saved, and only when the user is signed in.
- Database and server: Supabase, project region
ap-south-1(Mumbai, India): accounts, saved workflows, run summaries, receipts, approvals, connection keys (in the encrypted vault) and chats. - The app's pages are static files served by Cloudflare. They hold no customer data.
- The public tool for AI assistants (MCP and A2A) processes what it is sent in memory and does not store it.
3. Who can see what
- Every table with customer data has row-level security: an account sees only its own rows. The anonymous key can't read them.
- Keys for WhatsApp, Claude and databases are typed by the owner only into Nityaflow's Connections page, go straight to the encrypted vault, and are used only inside the server. They are never sent back to the browser.
- Links that let other AIs run workflows are stored only as hashes, can be removed at any time, and only reach workflows the owner opened to AI agents.
- Every run obeys the owner's limits (mandate): message counts, allowed numbers and sites, read-only database, money limits that need a person's approval.
- Workflow code runs in a separate sandbox with no network, no secrets and a time limit. Web requests from workflows can't reach private or internal addresses.
- WhatsApp webhooks are accepted only with Meta's signature. Public endpoints are rate-limited.
4. Receipts and the signing key
- Receipts are fingerprinted with SHA-256 and signed with Ed25519. The private key is kept in the encrypted vault and used only by the server. The public key and the format are published on the receipt format page.
- A signed-in account's receipts form a chain: each one names the one before, so none can be dropped, inserted or reordered without it showing.
- Anyone can check a receipt in their browser with only the public key, without trusting Nityaflow's server.
5. How long data is kept
| What | Kept | Why |
|---|---|---|
| Receipts and check summaries | Until the owner deletes them or the account | They are the owner's records. (GST law expects accounts to be kept for several years.) |
| Receipt chain | For the life of the account | Holds only fingerprints and numbers; needed so the chain can be checked |
| Workflow run history | 400 days, then deleted automatically | Steps, counts, timings and errors only; no item data |
| Approvals | Item previews and saved run state cleared 400 days after the decision; who decided and when is kept | Previews can contain customer details |
| Seen WhatsApp message ids | 3 days | Only to avoid handling a message twice |
| Chats with Arvi | Until the owner deletes them | Chat history (no file contents) |
| Account, workflows, connections | Until deleted by the owner; whole account within 7 days of a request | See the privacy policy |
6. If something goes wrong
- Contain: revoke affected keys and links, switch off affected workflows, rotate the signing key if it could be exposed (old receipts stay checkable against the published old key).
- Report: to CERT-In within 6 hours of noticing a reportable incident, as its April 2022 directions require; to affected users promptly; and, once the DPDP Rules' breach duties apply (13 May 2027), to the Data Protection Board without delay, with a full report within 72 hours.
- Fix and explain: find the cause, fix it, and write up what happened, what data was involved and what changed.
Report a security problem to hello@nityaflow.in with "Security" in the subject.
7. Services and AI models used
| Service | Used for | Data it sees |
|---|---|---|
| Supabase (Mumbai region) | Database, sign-in, server functions, encrypted vault | Everything saved in an account |
| Cloudflare | Serving the app's pages | Page requests only |
| Anthropic (Claude) | AI steps, workflow building and Arvi's understanding, only with the owner's own Claude key | The prompt or message sent; Arvi sends the chat text, never file contents |
| Meta WhatsApp Cloud API | Messages, approvals and receipts on the owner's own WhatsApp number | The messages sent and received |
| Google Fonts | Loading fonts | Page requests only |
AI models: Claude Haiku 5.5 by default, Sonnet 5.5 or Opus 5.5 where the owner chooses. AI never decides a check result: recipes and an independent checker do, and a person approves.
8. What is not in place yet
- No outside security review or penetration test yet, and no ISO 27001 or SOC 2 report.
- Checking new passwords against leaked-password lists is not switched on yet.
- One administrator; no formal access review or on-call rota yet.
- No signed data processing agreements with the services above beyond their standard terms.
9. DPDP Act readiness (review of 25 October 2026)
The DPDP Rules were notified on 13 November 2025. Most duties for businesses (notice, consent, security, breach reporting, retention, users' rights) apply from 13 May 2027. Where Nityaflow stands today:
| Duty | Today | To do before 13 May 2027 |
|---|---|---|
| Notice | Privacy policy says what is stored and how to delete it | An itemised notice of each kind of personal data and its purpose, with links to withdraw consent, use rights and complain to the Board |
| Consent | Sign-up, early-access form with a consent box | Consent as easy to withdraw as to give; delete on withdrawal unless law needs it kept |
| Security safeguards | Sections 3 and 4 above | Outside review; access review; backups test |
| Breach reporting | Process in section 6 | Practise it once; template for the Board and users |
| Logs kept one year | Run history and approvals kept 400 days | Decide whether the 3-day WhatsApp message-id cleanup must be longer |
| Users' rights | Delete yourself, or by email within 7 days | Add access and correction requests; publish a contact for privacy questions |
| Processors | Standard terms | Data processing terms with each service in section 7 |
| Customers' end users | WhatsApp senders handled on behalf of the business | Make clear in terms that the business is the data fiduciary and Nityaflow processes for it |
This is a working review, not legal advice. Have a lawyer confirm it before relying on it.