Security at CXOView
Last updated 25 July 2026
Firms hand us the identifiers and records behind their clients’ statutory compliance — PAN, TAN, GSTIN, director details, payroll data and challans, across their whole book of clients. We treat that as sacred. This page describes, in plain terms, the measures we take to protect it. It sits alongside our Privacy Policy and Terms.
All traffic to the Services is served over TLS 1.2+/HTTPS. Plain-HTTP access is redirected and HSTS is enforced in production.
Data is encrypted at rest using AWS KMS envelope encryption. Sensitive credentials (OAuth, SMTP/IMAP) are additionally encrypted with AES-256-GCM at the application layer before they are stored — never kept in plain text.
Passwords are stored only as salted one-way hashes (bcrypt, cost 12). One-time passcodes for two-factor sign-in are stored hashed and expire within minutes. Sessions use signed, expiring tokens in httpOnly, secure, sameSite cookies.
Every read and write is scoped to the signed-in firm. Cross-firm access returns a 404 and is recorded to a security log, and tenant isolation is verified by a dedicated automated test suite we run before each change. One firm can never see another firm’s clients or data.
Access is scoped to what each user’s role and service assignments allow, with salary/payroll data gated separately. Administrative surfaces are gated and invisible to unauthorised users — they receive a 404, not a hint that the surface exists.
Authentication, one-time-passcode and data endpoints are rate-limited (e.g. login attempts per IP), with lockout after repeated failures, to resist brute-force and abuse. Uploads are size- and type-validated.
Privileged actions are recorded to an append-only security-event log, sensitive list endpoints log read access, and every filing carries a verification record — who recorded and verified it, and when. Administrators can review the audit log.
Infrastructure, database and document storage run on AWS Asia Pacific (Mumbai) — ap-south-1, India. We aim to keep personal data within India.
Server-side validation of input, parameterised database queries (no string-built SQL), React output escaping, security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and dependency review as part of our development process.
Data is stored in managed AWS RDS with automated daily encrypted snapshots. We continue to validate our restore procedures as we grow.
Data protection & breach response
We are building CXOView to align with India’s Digital Personal Data Protection Act, 2023. For data inside the product we act as your firm’s Data Processor, processing it on your instructions. We do not sell personal data and we do not train AI or machine-learning models on your data. In the event of a personal-data breach, we will act to contain it and will notify affected parties and the Data Protection Board of India as required by law, working to a 72-hour notification commitment.
Honest about our stage
We build to the intent of recognised frameworks such as ISO 27001 and SOC 2 — least privilege, tenant isolation, encryption, audit logging and secure development. To be transparent, we are not currently certified against those standards, and we do not claim certifications we do not hold. As we grow we intend to pursue formal assessment. No system is perfectly secure, but we work continuously to protect your data and to be straight with you about where we are.
Reporting a vulnerability
If you believe you have found a security issue, please email admin@cxoview.in with the details. We appreciate responsible disclosure and will work with you to verify and address genuine issues promptly.