Platform
Security you can check.
Two-factor sign-in, a tamper-evident audit trail and encrypted personal data. Zero access to your records after go-live.
- Core ready in 1–2 weeks
- 100% customisable
- Zero access to your data
- Updates and fixes included
- Changes whenever you want
Two-factor sign-in
Enter the 6-digit code from your authenticator app
Lost the phone? Use a one-time recovery code.
Employee · Kavya Rao
- PAN
- •••• 1234
- Bank account
- •••• 4417
Encrypted with AES-256-GCM. Every Show is logged.
Audit trail
- Priya S. changed Credit limit on Kaveri Agencies: ₹2,00,000 → ₹3,00,000
- Ravi K. pressed Show on Kavya Rao’s bank account
- Hash chain checked: no entry altered or deleted
- Part of
- Every module
- the platform under every app and module
- Users
- Unlimited
- no per-user fee on any module
- Runs on
- Your server
- or a dedicated system on MyRecords Cloud
- Core ready in
- 1–2 weeks
- set up by our team with the modules you pick
How we work with you
Your data stays yours. Zero access after go-live.
Once you go live, our team does not open your records. For a fix, you grant access for that job, and it ends with the job.
-
Pick what you need. We set it up.
Choose from the modules and features that already exist. We set up everything: your data, users, print formats and training.
-
100% customisable
Fields, screens, workflows and reports, changed by our team to fit the way you work. Quoted before we start.
-
Rebuilt around you, if needed
If your process needs it, we redesign and rebuild any part of the system to your requirement.
-
Zero access to your data
Once you go live, our team does not open your records. For a fix, you grant access for that job, and it ends with the job.
-
Regular updates and bug fixes
Regular updates and bug fixes, included in every cloud plan and AMC tier, with GST, TDS, PF, ESI and PT changes.
-
Changes whenever you want
Ask for a change, an addition or a fix at any time, and our team takes it from there.
In short
MyRecords protects your data with two-factor sign-in and recovery codes, a read and write audit trail chained with hashes so a deleted or altered entry is caught, and AES-256-GCM encryption of PAN, Aadhaar, passport and bank account numbers, which show masked until someone allowed clicks Show. Sign-ins and API calls are rate-limited, backups are encrypted, and the DPDP tools record consent and handle erase and data requests. It has passed our own security, permission and AI safety tests; it has no ISO 27001 or SOC 2 certificate and no external penetration test yet.
The details
What it covers.
8 of 10 work today
- Works today 8
- Once connected 1
- In part 1
-
Two-factor sign-inWorks today
An authenticator app code at sign-in, with ten one-time recovery codes if the phone is lost. On new systems it is on for administrators from day one; switch it on for everyone or by role. Codes by e-mail, SMS or WhatsApp work once those are set up.
-
Single sign-onOnce connected
Sign in with Google, or through your company's SAML or OpenID Connect identity provider. Works once you connect your provider.
-
Tamper-evident audit trailWorks today
Every change to a tracked record is kept field by field, and every view of a sensitive record is logged, as are exports and each Show of a hidden number. Entries are chained with hashes and checked every night, so a deleted or altered entry is detected. Kept for 8 years.
-
Encrypted personal dataWorks today
An employee's PAN, Aadhaar, passport, IBAN, UAN and bank account, a customer's or supplier's bank account number and a borrower's CKYC number are encrypted with AES-256-GCM, a fresh key per value, tied to its record and field. Provider keys sit in an encrypted store and are blanked out of error logs.
-
Masked by defaultWorks today
These numbers show as •••• 1234 on screens, lists and exports. Show reveals the full number only to people allowed to see it, such as HR or the employee, and each Show is logged.
-
Passwords, sessions and limitsWorks today
Weak and commonly leaked passwords are refused. An account locks after 5 wrong passwords in a row, and one address may try 20 sign-ins in 5 minutes. A session ends after 24 hours idle and 14 days at most. API calls are limited to 600 a minute per user. People get an e-mail when their access changes or they sign in from a new place.
-
Safe uploads and web protectionsWorks today
Uploads are limited to common document, sheet and image types up to 25 MB, and a renamed file is refused. Virus scanning of every upload can be switched on. Every change needs a valid request token, and pages carry a strict content security policy and HTTPS-only headers.
-
DPDP Act toolsWorks today
A privacy notice, consent records with one-click withdrawal that also stops bulk e-mail, erase requests confirmed by e-mail and approved by an administrator, "send someone their data" as a file, and grievance and breach contacts.
-
Tested by our own teamWorks today
A security review, permission-bypass testing, AI safety tests (prompt injection and data leaks) and dependency scans, all in-house. Our security round of 2 Nov 2026 logged 176 findings, none critical; every high-severity finding in the product was fixed or mitigated.
-
No certificates yetIn part
There is no ISO 27001 or SOC 2 certificate and no external penetration test (VAPT) yet. Ask us for the in-house test results.
Said plainly
Not there yet
- ISO 27001 or SOC 2 certification.
- An external penetration test (VAPT) by an independent firm.
Questions
Questions people ask
Something else on your mind?
Ask us anything about it. A person from our team replies.
Ask a question01Is my data encrypted?
Identity and bank numbers (PAN, Aadhaar, passport, IBAN, UAN and bank accounts) are encrypted in the database with AES-256-GCM. Backups are encrypted with AES-256, all traffic uses HTTPS, and provider keys are kept in an encrypted store.
02Can anyone change the books without a trace?
Every change to a tracked record is kept field by field with who and when. The entries are chained with hashes and checked every night, so a deleted or altered entry is reported.
03Do you have ISO 27001, SOC 2 or a VAPT report?
Not yet. MyRecords has passed our own security, permission and AI safety tests. We will say so on the security page when an external test or certificate is done.
04Does it help with the DPDP Act?
It gives you the tools, namely a privacy notice, consent records with withdrawal, erase requests with approval, data export for a person, and grievance and breach contacts. Your obligations as the data fiduciary remain yours.
05Can your staff see my data?
No. Once you go live, our team does not open your records. If you need help with something, you grant access for that job, and it ends when the job does. On your own server, access is yours to give or refuse.
Last updated Applies to MyRecords 3 Nov 2026 release
Next step
See it on your own numbers.
A live demo on our sample company, with our team. Or ask us for a quote first.
Live demo
Book a walk-through
- On our sample company, for your kind of work
- A quote for the modules you need
- Your questions, answered by our team