Security & data
How client records are kept.
A consultant’s licence depends on the accuracy and confidentiality of what is on file. This is what the product does, and what we will confirm in writing on request.
Separation between practices
Every practice’s data is held under its own practice identifier. The server takes that identifier from your authenticated session and never from the request itself, and it refuses to link a record to another practice’s row. Cross-practice access is covered by an automated test suite that we treat as a release gate.
Role-based access
Four roles: owner, admin, member and read-only. Read-only users cannot write anything. Passwords are stored as salted hashes, never in readable form.
Audit trail
Calls, emails, SMS and notes are logged against the file they concern. Retainers signed in the product store the executed PDF with the signing record. Provincial certificate renewals are new rows, so the file shows which certificate was in force on the day a filing went in.
Documents
Uploaded documents are stored outside the public web root and are never served as static files.
Client links
Clients reach their onboarding and signing pages through a link you issue and can revoke. There is nothing for them to install and no password for them to keep.
Backups
The database is backed up nightly, with retention.
What we do not claim
We do not claim a compliance certification. If your practice needs to know where data is hosted, how long backups are kept or how a specific request would be handled, ask, and we will answer in writing before you sign anything.
To report a security concern, write to ankit@khoshasystems.com.
Book a demo, or sign in.
Thirty minutes, against a file of your own. No card, no obligation.