Regulatory Integrity

Compliance Center

v1.0.0 | Updated September 7, 2026

Encrypted on Your Device

AES-256-GCM at rest in your browser, under a PIN-derived key held only in memory. We hold no copy, so there is no vault of ours for anyone to breach.

DPDP Act, 2023

The governing law. Notice, purpose limitation, erasure, breach notification and every Data Principal right are set out in the Privacy Policy, with how to exercise each one.

Published Rates and Rules

Slabs, limits and rates are versioned constants, each recorded with its source and the date it was last checked. That is traceability, not an audit — no external auditor reviews them.

Portability and Erasure

Export as JSON or an encrypted backup whenever you like; clearing your data removes it outright. We claim no GDPR or CCPA certification — the design simply leaves little for either to reach.

Algorithmic Transparency

Trezoriq provides open logic documentation for every financial engine. We do not use "black-box" algorithms. All math is based on standard financial formulas and official Indian tax laws as of FY 2026-27.

Verified against the Income-tax Act, 1961 and the Income-tax Act, 2025

Rates, slabs and statutory limits are held as versioned constants with the source and the date they were last checked recorded alongside them, so a figure on screen can be traced to what it came from. Residency already accounts for the Income-tax Act, 2025 governing tax years from 1 April 2026, and cites whichever Act applies to the year being shown.

Data Sovereignty

Your financial data is processed on your own device, inside your own jurisdiction, because it never goes anywhere else. Being precise about the rest matters more than a blanket claim:

  • Your financial data is not transferred anywhere — there is no server holding it, in India or outside it.
  • Encryption keys are derived from your PIN on your device and never leave it.
  • The site and its database run on hardware we operate ourselves, so hosting is not a third party and server logs do not leave it.
  • Crash reporting is on. What it sends is a stack trace, the page it happened on, and a sampled performance trace, to an error-monitoring provider that may be outside India. Before anything is sent, numeric amounts are stripped out of it, and your stored data is never attached — session recording is off, and storage dumps are removed rather than masked.
  • Usage analytics, where it runs, is cookie-free and counts page views only — no identifier is set, nothing follows you between sites, and there is no profile to join it to. It can be switched off for a deployment entirely, and when it is off no request is made to the analytics provider at all.
  • Optional features you switch on may involve providers outside India — the AI providers, and Google Drive if you enable backup. Bundles are encrypted on your device before they are uploaded.
  • We keep no audit log of your activity, because we have no account to attach one to.

Your rights under the DPDP Act, 2023

The Act gives you rights as a Data Principal against whoever holds your data. The honest position here is unusual and worth stating plainly: for your financial data we hold nothing, so most of these rights are ones you exercise directly, on your device, without asking us.

  • Access: everything is already on your device. Settings → Data Management exports the lot as an encrypted backup.
  • Correction: edit any figure in the app. There is no second copy elsewhere that could disagree.
  • Erasure: Settings → Data Management → clear all data removes it. Clearing your browser storage has the same effect. Neither requires a request to us, because we have nothing to delete.
  • Withdrawing consent: every optional feature that transmits anything — AI, Drive backup, the statement inbox, CA sharing — can be switched off in Settings, and takes effect immediately.
  • Grievance redressal: for anything we do hold — error reports, request logs, a CA share you created — contact the Grievance Officer named in section 11 of the Privacy Policy. If our answer does not satisfy you, section 13 of the Act lets you take it to the Data Protection Board of India.
  • Nomination: the Act lets you nominate someone to exercise your rights if you die or are incapacitated. Since we hold no account, the equivalent here is practical rather than legal: the Legacy Desk records where things are, and an encrypted backup plus its password is what actually passes access on.

You may also complain to the Data Protection Board of India. Nothing on this page limits that right, and none of it is legal advice.