Security & trust
Built like compliance infrastructure, not a demo
Sorted handles PAN, Aadhaar-linked KYC, bank data and financial statements. Here's how that's protected.
Tenant isolation, enforced in the database
Every company, filing and document is scoped to its organisation with Postgres Row Level Security — not just hidden in the UI. A professional can only see companies and filings they're explicitly assigned to.
Private documents, signed links only
Documents live in a private storage bucket. Every view goes through a short-lived signed URL — there is no public link to a customer's PAN, financials or KYC documents.
Human-authorised government access
CAPTCHA, OTP, MFA and digital signature confirmation always stay with an authorised human operator. Sorted's mock and manual filing providers never attempt to bypass portal security, and neither will any future automation.
Immutable audit trail
Every sensitive read, write, review, approval, reassignment and submission attempt is recorded in an append-only audit log — nothing is ever edited or deleted after the fact.
Transactional, idempotent workflow
Filing status changes are transactional, permission-checked and version-guarded against concurrent edits. Government submissions carry an idempotency key so a retried request can never file the same form twice.
No secrets in logs
DSC PINs, portal passwords and OTPs are never stored, and error logs are sanitised before they're written — a stack trace is never shown to an end user.