Data residency
Indian customer data stays in India
Encryption
AES-256 at rest, TLS 1.3 in transit
DPDP Act 2023
Consent-first access, recorded and auditable
Model training
Your client data never trains shared models
Storage & residency
Where documents and derived data physically sit.
Primary region
Client data for Indian customers is stored and processed in India, in AWS Mumbai, with encrypted backups replicated to AWS Hyderabad. No copy is held outside India.
Object storage
Documents held in an encrypted object store with versioning enabled, so a superseded draft can always be produced for audit.
Backups
Daily encrypted backups retained for 30 days, replicated to AWS Hyderabad and restored in-region. 99.9% uptime SLA on paid plans.
Tenant separation
Logical isolation per firm or entity. No shared document buckets, and no cross-tenant search index.
Sub-processors
Cloud, messaging and model providers — all operating within India — are listed in a current sub-processor register, available on request and updated with notice before any change.
Access & consent
Who can reach a client record, and on what authority.
Consent-first pulls
Every portal fetch — Income Tax, GST via a registered GSP API, TRACES, the trademark registry — requires explicit client consent. Consent records carry a timestamp and are exportable.
Role-based access
Partner, manager, associate and viewer roles with client-level, module-level and action-level permissions. Multi-factor authentication throughout.
Maker-checker
Filing, dispatch and other irreversible actions require a second qualified approver. The approval is part of the record.
EnterFirst staff
Support access is request-based, time-boxed and logged. Verification experts see only the matter assigned to them, never a firm-wide view.
Audit trail
Every view, edit, version and approval is timestamped and immutable, and can be exported in full for a regulatory review or internal audit.
Retention, AI & exit
How long we hold it, what the models do with it, and how you leave.
Retention
Matter data is retained for the statutory period applicable to that filing, then deleted on schedule — or earlier on your written instruction.
Deletion
Deletion propagates to backups within the backup cycle. A deletion certificate is issued on request.
Model training
Your client data is never used to train shared or third-party models. Drafting runs against your documents, for your matter, and the output is yours.
Human verification
A lawyer, CA or company secretary reviews AI output before it is filed or dispatched. Model confidence is never the last step.
Data portability
Full export of client data, notices, evidence files and audit trails in CSV, Excel or JSON — at any time, with structured handover assistance on enterprise plans.