Skip to content

Is GrowProfit secure?

Read-only by design. Locked down by default.

GrowProfit only reads the statements you give it. It can’t trade, it doesn’t advise, and it never fills a gap with a guess. Everything it holds sits behind two locks and six layers, so you don’t have to take our word for it.

  • No broker passwords
  • Data kept in India
  • Every read logged

GrowProfit’s access to your account

Read-only
  • Read the statements you uploadAllowed
  • Place a tradeNot possible
  • Move your moneyNot possible
  • Give investment adviceNever
  • Guess a value it can’t knowShows “—”
  • Charge to download your reportsNever
  • Let support see your accountOnly if you grant it

There’s no trading or payment connection to switch on, so this access can’t be widened by a setting.

How it’s built

Two locks on everything.

The application checks who you are and what you may see on every request. Then the database enforces it again, on its own, with a rule the application can’t switch off.
Lock 1The applicationChecks your session, your role and your scope on every request.
Lock 2The databaseRow-level security on every table, which the serving role cannot bypass.
Your portfolioBehind both, every time

Every build tries to cross from one account into another, and must fail before it can ship.

Step by step

What protects you, at every step.

From the moment you sign in to the record under everything, this is what guards your data, and only what is built.
  1. 01

    When you sign in

    A strong door, and an optional second lock.

    • Passwords of at least 12 characters, stored with Argon2id
    • Two-factor with an authenticator app, and 10 recovery codes
    • No SMS codes, by design: SIM swaps can’t reach you
    • Signed out after 2 idle hours, never between 9 AM and 4 PM IST; one live session at a time
  2. 02

    When you upload a statement

    Scanned first, then read in a sealed room.

    • Every file is scanned for malware before it is read
    • The reader runs with no internet access and no database credentials
    • Its filesystem is read-only, and it holds no privileges
    • Nothing is recorded until you’ve seen the preview
  3. 03

    While your data is stored

    Fenced by the database, not just the app.

    • Row-level security on every table that holds your data
    • The role that serves requests cannot bypass it
    • Every build tries to cross between accounts, and must fail
    • PAN, date of birth and phone encrypted with a key per person
  4. 04

    When you share with your CA

    Exactly what you choose, for as long as you choose.

    • Read-only, scoped to the portfolios and reports you pick
    • 30 days by default, 90 at most, revocable any time
    • Creating a link asks you to confirm it’s you again
    • Every open is logged, so you see when it was last used
  5. 05

    If you ever need support

    No one looks without your say.

    • Support can see your account only if you grant it
    • Read-only, for up to 24 hours, and you can revoke it
    • Every operator signs in with a second factor
    • Every read is logged with both your names
  6. 06

    Through all of it

    A record that can’t be quietly changed.

    • An append-only audit log in its own database
    • Each entry chained to the last, and re-verified every 5 minutes
    • Sign-ins, grants, deletions and every ledger change’s origin
    • Consent stored with the exact version of the notice you accepted

Your data

Yours to keep, yours to take away.

Where it lives, what you agreed to, and how you leave with all of it. The privacy notice has the detail.

Read the privacy notice

  • Kept in India

    Mumbai, with backups in Hyderabad. Report emails are sent from India too. Only account and security emails go through a provider in the United States.

  • Take it with you

    Download any report or table as CSV, Excel or PDF, on every plan.

  • Consent you can read again

    Each purpose has a versioned notice, stored with your consent, and can be withdrawn as easily as it was given.

  • Deletion you can see

    Recoverable for 7 days, then purged within 30, with a signed confirmation. Your encryption key goes with it.

Questions

Asked first about security.

Including what isn’t built yet. Anything else, ask in the chat at the bottom of the page.

Get startedPrivacy, terms and more

No. You upload the statements you already download. Where a source can be connected, it uses the provider’s own consent flow, and GrowProfit never stores a broker password.

Only if you grant it. Support access is read-only, lasts up to 24 hours, can be revoked at any time, and every read is logged with both names.

Export everything first, on any plan. A deleted workspace can be recovered for 7 days, then it’s purged within 30 days and you get a signed confirmation.

No. There is no trading or payment connection to switch on. GrowProfit reads statements and reports on them, and that access can’t be widened by a setting.

In India: Mumbai, with backups in Hyderabad. Primary data, replicas, backups, logs and stored files all stay in India, and report emails are sent from India. Only account and security emails, such as sign-in codes and password resets, pass through an email provider in the United States.

GrowProfit is software for tracking and reporting. It isn’t a broker, adviser or distributor, holds no registration as one, and never sells you financial products.

Your entire wealth. Finally, together.

Start with the statements you already have. Nothing is recorded until you’ve checked it.

Get startedI advise clients

Analytics cookies

By clicking “Accept all cookies”, you agree GrowProfit can store cookies on your device and disclose information in accordance with our Privacy Policy.