Transparent Security & Data Policy

Security, Data Backup & Storage Guidelines

We believe in complete transparency with our merchants. Here is a clear overview of our active security controls, customer backup responsibilities, and data retention rules.

⚠️

Mandatory Policy: Plan Expiry & 90-Day Auto Data Deletion

1. Customer Backup Duty: GSTApply provides built-in 1-Click Excel Export functionality for all invoices, item stocks, customer ledgers, and transactions. Users must regularly download and save their own offline backups.(Keeping your own Excel backups by downloading your data regularly is the customer's responsibility.)

2. Post-Expiry 90-Day Grace Window: When a trial or subscription expires without renewal, an account enters a 90-day grace period during which the merchant can export their data or renew their plan.(After a plan expires you have 90 days (3 months) to download a backup.)

⛔ Accounts remaining expired, inactive, or unpaid for over 90 consecutive days are subject to permanent and automated data deletion from the database. Once purged, data cannot be recovered.(Data of accounts expired for more than 90 days is permanently deleted from the servers and cannot be recovered.)

3. Absolute Release of Liability: Neither GSTApply nor its operators shall bear any financial, legal, or compensatory liability for data purged due to plan expiration or user failure to maintain offline backups.

🔒Implemented Technical Security Controls

🌐

Standard HTTPS / SSL Encryption

Web traffic between your browser and our application servers is encrypted using standard SSL/TLS certificates, safeguarding credentials and billing transmissions from unauthorized network snooping.

🔑

Bcrypt Password Hashing

User passwords are never stored in plain readable text. Passwords undergo irreversible salted bcrypt cryptographic hashing prior to database persistence.

📥

1-Click Offline Excel Export

Merchants can export comprehensive item registers, transaction books, and party ledgers directly to Excel at any time for safe local archiving.

👥

Staff Role Access Controls

Owners can provision separate credentials for counter staff with permission limits preventing unauthorized visibility of purchase rates and profit margins.

Service Terms & "AS-IS" Disclaimer

GSTApply operates on standard shared cloud web hosting infrastructure. The service is provided strictly on an "AS IS" and "AS AVAILABLE" basis without express or implied operational warranties.

We do not guarantee 100% uninterrupted server uptime. Scheduled hosting maintenance, upstream provider disruptions, or local internet outages do not give rise to compensation claims.
Tax and compliance tools are general aids. Final return filings must be verified by the merchant with their qualified Chartered Accountant or Tax Consultant.
Under all circumstances, the total cumulative liability of GSTApply for any dispute is limited strictly to the subscription fees paid by the user in the preceding 30 days.

Exclusive Jurisdiction: New Delhi / Delhi, India

All matters, disputes, or legal actions related to GSTApply software, user data, or security policies are subject to the exclusive jurisdiction of the competent courts in New Delhi / Delhi, India only.

Vulnerability Disclosure Policy

We welcome good-faith security research on GSTApply. If you believe you have found a vulnerability, please report it privately so we can investigate and fix it before it is made public.

Contact: support@gstapply.com with the subject line SECURITY.
Please include: the affected URL or endpoint, clear reproduction steps, the potential impact, and any proof-of-concept material.
Our commitment: we aim to acknowledge reports within 3 business days and to keep you updated while we investigate and remediate.
Please do not: access, modify or delete data that is not yours; run denial-of-service or automated high-volume scans; use social engineering against our staff or customers; or disclose the issue publicly before a fix has shipped.
Safe harbour: we will not pursue legal action against researchers who follow this policy in good faith and avoid the prohibited actions above.
Out of scope: missing security headers on third-party marketing pages, reports from automated scanners without a demonstrated impact, and issues that require a compromised device or a malicious browser extension already installed by the user.

Machine-readable disclosure metadata is published at /.well-known/security.txt.

Acknowledgments

With permission, we credit researchers who report valid issues. No researchers have been acknowledged publicly yet.

Need Assistance With Data Backup?

If you need help exporting your offline Excel backups before your subscription concludes, contact our team:

WhatsApp Support: +91 7827804617 | Email: support@gstapply.com