Security
What we do with your details.
What we encrypt, what we never see, and where your data is kept. If any of it changes, this page changes.
Your PAN and bank details are encrypted
PAN, bank account numbers, contact details and nominee details are encrypted with AES-256-GCM before they reach our database. The keys live on our servers, not in the database, and can be rotated. Details are decrypted to send to BSE when your account is set up or changed. Our support team sees them masked. Showing a full PAN needs an admin and a written reason, and goes in an audit log.
We never see your passwords or payment PINs
You sign in with Google, Apple or a one-time code sent to your email, so there's no password for us to store or leak. Payments go through BSE's payment gateway. Your UPI PIN and net banking password never reach us.
The app locks itself
The app asks for your PIN, fingerprint or face when you come back to it after a few minutes away. Too many wrong PINs and it signs you out. Screens with your PAN, bank details, portfolio or payments block screen recording, and on Android, screenshots too.
Your data stays in India
Our database is in Mumbai and our servers are in Bangalore.
Ask doesn't see your identity
Before a message goes to the AI model behind Ask, we remove PAN, Aadhaar, email, mobile, IFSC and account numbers from it, and tell you what we removed.
Your money never sits with us
Payments go from your bank to the fund house through BSE StAR MF. Units are held in your name at the fund house, and you can see them on CAMS or KFintech without us.
Your data, your call
From Settings in the app you can download a copy of your data or delete your account.
Reporting a security problem
Write to sahihaimf.ai@gmail.com with "Security" in the subject. A person reads every one.