A CAS statement is one of the most revealing documents an Indian investor owns: your PAN, your email, your mobile number, your folio numbers, and every holding with its cost. Any product that asks for it owes you a precise answer about what happens next. This is ours.
The principles
- Personal data never leaves the secure boundary. Your CAS PDF is processed inside the platform's own infrastructure.
- Mask before anything else. PAN, email, mobile, and folio identifiers are sanitized as the first pipeline step, before parsing and before any AI runs.
- Cloud AI sees public data only. Market and fundamental questions — prices, ratios, sector data — may be answered by a hosted model. Anything that depends on your portfolio goes to a locally hosted model.
- Retention is finite and stated. Uploaded documents are purged automatically after 30 days.
What gets masked
| Identifier | Handling |
|---|---|
| PAN | Masked before parsing |
| Masked before parsing | |
| Mobile number | Masked before parsing |
| Folio numbers | Masked before parsing |
| Holdings, quantities, costs | Kept — required for scoring, never sent to cloud AI |
The scoring engine consumes holdings and quantities. The language model that writes your narrative insights consumes scores and anonymized aggregates, not account identifiers.
Where processing happens
- Statements and PII-bearing data → local processing on iNiveś infrastructure. Nothing personal is shipped to a hosted model.
- Public market data → may use a hosted model (Google Gemini) for market perspectives and educational context.
- Duplicate detection → every upload is SHA-256 hashed so the same statement is never processed twice.
Sensitive fields at rest are encrypted with Fernet symmetric encryption.
How long data lives
- Uploaded statements: automatically purged after 30 days.
- Computed scores and holdings snapshots: retained while your account is active, since they are the portfolio's history.
- Account deletion: personal data is deleted on request; scores derived from your data are removed with the account.
Your rights under the DPDP Act
India's Digital Personal Data Protection Act gives you the right to access, correct, and erase your personal data, and to know why it is processed. In practice:
- Access — your portfolio history is visible in the product at any time.
- Correction — re-upload a corrected statement; it replaces the prior snapshot.
- Erasure — delete your account and personal data is removed.
The short version
Your CAS file is used to score your portfolio, is masked before anything else touches it, is never sent to a cloud LLM, and is deleted after 30 days. The scores derived from it stay with your account until you delete it.
If you believe any of this is not happening, the security page describes how to report it — and a report is treated as a critical incident, not a support ticket.