Security
What is in place today, and what is not.
Compliance records are confidential. Here is how Delta Filings handles them now, written so you can decide whether it is enough for your company. Where something is missing, we say so.
In place
What we do today.
- Encrypted in transit. The site is served over HTTPS and session cookies are marked secure and HTTP-only.
- Managed sign-in. Accounts use email and password through Supabase Auth. We do not store your password.
- Your records are yours alone. Every query is scoped to your account, and another user's record returns "not found". Your review decisions and notes are visible only to you. This is covered by automated tests.
- PAN masked on screen. PANs show as AB•••••34K in tables and are shown in full only in the exports you ask for.
- Tamper-evident insider-trading log. Entries cannot be edited or deleted through the app. Each stores the hash of the one before, and the page names the first broken entry. UPSI records, trading-window closures, pre-clearance decisions and the designated persons list are chained too, and deleting the newest entries is detected.
- Client uploads are fenced. Document-request links are long random tokens. Files are checked for type and size, stored under random names, and sent back as downloads. Closing the request switches the link off.
- History kept. Register edits are saved as new versions, and risk alerts keep a log of every action.
Not in place
What we do not have yet.
- India hosting. Data sits on a Railway server in US West (California).
- Scheduled off-site backups. We do not run our own. Export your registers and logs to keep your own copy.
- Multi-factor sign-in and single sign-on. Not built.
- Team roles and a full audit log. Accounts are per person. Some modules keep logs; there is no single trail across the product.
- Certifications. No ISO 27001 or SOC 2 report.
- A signed data-processing agreement, and tools for deletion and export requests under the DPDP Act.
- The insider-trading chain is anchored in the database only. Someone with direct database access could rebuild it. Record the head hash in your minutes to cover that.
Data handling
Who else touches your data.
| Service | What for | What it sees |
|---|---|---|
| Railway | Hosting and storage | Everything stored in the app, including uploaded documents |
| Supabase | Sign-in | Your name, email, role and password hash |
| Google Gemini, OpenRouter | AI summaries and drafting, only when you use them | The text you send for that request |
| Google Analytics | Page-view statistics on this site and the app | Page views and device details, not your records |
| Telegram | Alerts, only if you link it | The alert text |
| Razorpay | Payments, once billing starts | Payment details, handled by Razorpay |
We do not sell data and we do not train models on it. AI providers have their own terms: avoid sending text you may not share with them.
Choosing whether to use it. Delta Filings is in beta. For a listed company or a regulated entity, the missing items above may block procurement today. For a practice or an unlisted company that wants a better calendar, they are usually acceptable. If you need something specific, tell us before you rely on it.