Security
Controls for financial documents
Your clients send Fyliio their bank statements and invoices, so security is not a feature list. When something does not check out — a message without a valid signature, a request without a firm, a file the AI is unsure about — Fyliio rejects it or sends it to your team. It never guesses.
Each firm kept separate
Every request is limited to the firm the staff member is signed in to, so one firm can never see another firm’s clients or files. Your clients never get a login.
Only genuine WhatsApp messages
Every incoming message is checked against Meta’s signature before Fyliio reads it. A message that fails the check is rejected, so no one can post fake documents into a client’s checklist.
Encrypted connections, expiring links
Everything travels over HTTPS. Staff logins use cookies that page scripts cannot read. Files are stored under random names and opened only through links that expire after 60 seconds.
Designed around DPDP Act principles
Documents are used only to collect and check filings for your firm. WhatsApp files are deleted automatically after 90 days. We never sell client files. Client documents are never used to train AI models, ours or our providers’. See the Privacy and Data policies.
Life of a file
What happens to a document after a client sends it
Six steps, from the first WhatsApp message to automatic deletion.
- 01
It arrives from WhatsApp
Each incoming message is checked against Meta’s signature before Fyliio reads it.
- 02
It is saved first
The message is stored before any processing, so a failure later never loses a client’s document.
- 03
It is stored under a random name
Files sit in authenticated storage with random keys. They are not publicly listed.
- 04
It is classified, never guessed
An AI model compares the file with the items still open for that client. Anything unclear goes to your team.
- 05
It opens through a short-lived link
Staff see files through links that expire after 60 seconds. Clients never get a login.
- 06
It is deleted after 90 days
WhatsApp messages and files are deleted automatically 90 days after they arrive.
Transparency
Who touches your data, and what we refuse to do
Data is stored outside India: the database in Singapore and files with our storage provider. The Data policy lists every provider.
Providers and their role
- Meta WhatsApp Cloud API: delivers and receives messages and media
- Anthropic (Claude): classifies a file against the open checklist; processed outside India
- Cloudinary: holds document files under random keys
- Neon PostgreSQL on AWS Singapore: the database
- Railway: runs the website, API and scheduled jobs
- Resend: sends staff login codes, not client documents
What we never do
- Sell client lists or documents
- Use client files to train AI models, ours or our providers’
- Keep a second copy of your files in a client portal
- Guess a document type when classification fails
FAQ
Frequently asked questions
Can one firm see another firm's clients or files?
No. Every request is limited to the firm the staff member is signed in to, and clients never get a login to the workspace.
How long are client files kept?
WhatsApp messages and the files clients send are deleted automatically 90 days after they arrive. The checklist status stays while your firm uses Fyliio, and you can ask for earlier deletion at any time.
Is client data used to train AI?
No. Documents are used only to collect and check filings for your firm. We never sell them, and client documents are never used to train AI models, ours or our providers’.
Where is the data stored?
The database runs in Singapore on Amazon Web Services and document files are held by Cloudinary under random names, so data is stored outside India. The Data policy lists every provider.
What happens if Fyliio is unavailable when a client sends a file?
Fyliio saves each incoming message before processing it, and Meta retries delivery if our API is down, so an acknowledged file is not dropped from our queue.
Want the details before you decide?
Read the Data policy for what is stored and where, or ask us anything about how documents are handled.