How CA ClientOps looks after your clients' documents
What the product does today, in plain words. CA ClientOps holds no security certifications yet; in October 2026 every page, sign-in path, upload and export was reviewed against the OWASP Top 10, and every finding rated medium or higher was fixed.
- Database
- Mumbai
- Files
- Cloudflare R2, Asia-Pacific
- Firm isolation
- Row-level security
- Partners
- Two-factor sign-in
- Files kept
- 8 years, then deleted
Each firm's data is kept apart
- Every table that holds a firm's data carries row-level security in Postgres. Each query runs for one firm, and the database itself refuses rows that belong to another.
- The app connects to the database as a role that cannot bypass those rules. Only schema changes use the owner account.
- Inside a firm, staff see every client, and change only their own unless they are a partner or manager.
Sign-in
- Partners must sign in with two-factor: an authenticator app, with single-use recovery codes. Managers and staff can turn it on for themselves.
- Passwords need at least 10 characters, and common passwords are refused. Passwords are stored only as hashes.
- Each sign-in is a device session the person can see and end. Changing a password, a reset or deactivating someone ends their sessions.
- Sign-in, codes and password resets are rate limited. Reset links work once and expire.
Client links and files
- Upload links are long random tokens; only a hash is stored. A link works for 14 days, and staff can sign a client out of every device and link at once.
- Files a client sent earlier open only after a one-time code, valid for 10 minutes with 5 tries.
- Every upload is checked on its real bytes: the type must match the name, empty files are refused and repeats are not stored twice.
- A file opens only for staff of the firm that owns it, or for the client's own verified session. Previews open in a sandbox.
Where data is kept
- The database, with clients, contacts, checklists, messages and the audit trail, is Supabase Postgres in Mumbai.
- Files clients and staff upload, and exports, are stored in Cloudflare R2 in an Asia-Pacific location, which may be outside India.
- Everything travels over HTTPS, with a strict content security policy on every page of the app.
- The privacy notice lists every service that handles data, what it does and where.
Notice and consent
- Your clients read a short privacy notice before their first upload: who is asking, what is kept, why, for how long and their choices. Accepting it records the time and the version.
- By default, reminders wait until a client has accepted the notice or you have recorded their consent. Only the opening request goes before that.
- A client who replies STOP gets no more automatic reminders.
- When you sign up, a partner accepts a data processing agreement between your firm and Dinero Technologies Private Limited. The documents are written with India's Digital Personal Data Protection Act in mind.
Retention, export and deletion
- Each file is deleted eight years after it arrived; the record that it existed stays, marked as deleted for retention.
- A partner can export the whole firm at any time: every client, contact, checklist, message, audit line and stored file, in one zip.
- Remove a contact or a client with all their files when they ask. The audit trail keeps one line that it happened.
- After an export, a partner can delete the whole firm. Only a line with the firm's name, the date and who asked is kept.
Audit trail and support access
- Every change leaves a line: who, when and what. Exports, downloads of a checklist's files and support views are recorded too.
- CA ClientOps support sees your firm only when a partner grants access, for 24 hours, 72 hours or 7 days, and the partner can end it at any time. Support sees counts and failed jobs, never client names, documents or message text.
- AI checks are off unless a partner turns them on. A person at the firm confirms every suggestion.
The documents
Each has a version and a date. When one changes, the people it applies to are asked to read it again.
- Terms of serviceVersion 2026-10-11
- Privacy noticeVersion 2026-10-13
- Data processing agreementVersion 2026-10-13
Found a problem?
Write to info@dinerotechnologies.in with what you saw and how to repeat it. Please do not test against another firm's data.
Try it on next month's GST.
14 days free on the Growth plan's limits. A guided setup brings in your team, clients and checklists, and nothing goes to a client until you switch reminders on.