Skip to content
Skip to content
FOR CHARTERED ACCOUNTANTS AND TAX PRACTITIONERS

DPDP-compliant document collection. Built for how a CA practice works.

Your clients’ PAN, Aadhaar, Form 16 and bank statements are personal data under the DPDP Act. Confidential Dispatch lets you collect them the way the Act requires, so every filing’s documents arrive compliant and sit in one place.

Start free, no card required LIVE AT APP.CONFIDENTIALDISPATCH.COM · INDIA
02 · YOUR INTAKE TODAY

Multiple places. No single answer.

Mehta & Co. ITR filing FY 2025-26 Income tax return filing for FY 2025-26
PAN Card Document Form 16 Document Bank statement FY 2025-26 Document Investment proofs DocumentYour documents are kept for 7 years, then deleted. This link stays open for 14 days.
‹ RK Rajesh Kumaronline
Please share Form 16 & bank statements for this year10:02✓✓
PDFForm 16.pdf2 pages · PDF
18:40
PDFStatement.pdf6 pages · PDF
18:40
↪ Forwarded
JPGPAN card.jpg1 page · JPG
18:43 COPY 2
Rest on email.18:44
Message
Search mail
Compose Inbox12 Starred Sent Drafts
Rajesh Kumar19:02Re: Re: ITR documents – attaching PAN…
A. Mehta19:20Fwd: Fwd: Re: ITR documents – pls file
S. Iyer19:31Fwd: Re: ITR documents – saved to drive
Rajesh KumarMarlast year’s 26AS
Re: Re: ITR documents
RRajesh Kumarto me
Sir, attaching PAN and Aadhaar. Rest sent on WhatsApp.
JPGPAN card.jpg
JPGAadhaar.jpg
ReplyForward
+ New My Drive › Clients › 2025 › Rajesh Kumar Shared with 4
Files
PDFForm 26AS.pdf
PDFInvestment proofs.pdf
PDFForm16_final_v2.pdf
COPY 2
PAN card copy.jpg
COPY 3
✕ 6 DPDP CHECKS FAILED
03 · BUILT IN

DPDP-compliant collection.

Everything the Act asks for at collection. None of it by hand.

PAN cardJPG
PAN CardDocument
Form 16PDF
Form 16Document
Bank statement FY 2025-26PDF
Bank statement FY 2025-26Document
Investment proofsPDF
Investment proofsDocument
HOW IT GOES TODAY

It starts with a message.

Today a filing starts with a message: “send me your Form 16 and bank statements”. The documents arrive in three WhatsApp chats and two email threads, get forwarded to the person doing the return, saved to a laptop, and copied to a shared drive. Nobody told the client why the documents were asked for, how long they would be kept, or that they could ask for them back. Nothing records that they agreed.

UNDER THE ACT

Every step is a gap.

Under the Act, each of those is a gap: no notice, no consent that can be demonstrated, no retention date, no record. The client’s documents end up in multiple places, and when a client asks what you hold on them, or asks you to delete it, there is no single answer.

AND THE PRESSURE TO KEEP

So you keep everything, everywhere.

The pressure is not only the Act. ICAI’s code already binds you to keep client information confidential, and a filing’s records stay relevant for years after the return goes in, because a notice or reassessment can come long after. So you keep everything, everywhere, indefinitely. That is exactly what the Act no longer allows.

04 · ONE REQUEST, END TO END

One request, from your desk to their phone and back.

Every request goes out with what the Act asks for at collection: the notice, the consent, the declared purpose, the retention date, the proof record and the path for your client to exercise their rights. You do none of it by hand.

How it works, in full
05Afterwards, kept for 7 years

Then the documents delete on their own, on the date the notice promised, unless you say otherwise. Every step, from the notice to the deletion, stays on a record that cannot be quietly changed. And your client can ask for a copy, a correction or deletion from the link on their receipt, at any time.

05 · BUILT FOR HOW A CA PRACTICE WORKS

Built for how a CA practice works.

See every feature
01

Name documents the way you file them

Every document in a request has a name you can edit. “Bank statement” becomes “Bank statement FY 2025-26” as you type it, so what your client uploads is already labelled for the year.

02

One folder per client, newest on top

Every request you send a client sits in that client’s folder, newest on top. This year’s filing sits above last year’s without you moving anything.

03

Your client uploads in a minute, no login

They open the link on their phone, read the notice, agree, and upload, or fetch from DigiLocker where the document is available there. No account, no app, no password to reset. If they sent the wrong file they replace it while the link is open.

04

All client documents in one place

Not across email, WhatsApp, a laptop and a shared drive. One copy, in the client’s folder, with who viewed or downloaded it and when. No forwarding, no duplicates.

05

Consent for what you fetch yourself

Form 26AS and AIS you download from the portal, statements the bank sends you: these never pass through an upload, so send a consent request with nothing to upload. Your client reads the notice and agrees on their phone, and the consent sits beside the documents you already hold, with a retention date and a confirm-deleted step at the end.

06

Keep sending the way you do

Copy the link into the WhatsApp chat you already have with the client, or open it pre-written in WhatsApp with one tap, or let the system email it. The chat stays the chat; the documents stop travelling through it.

07

Your name and your logo, every time

Your firm’s name is on every message the client gets, and your name and logo are on the page they upload to, so they know the request is from you and not a phishing attempt.

08

Accounts for your staff, admin for you

Invite your team; the work belongs to the firm, not to whoever did it. Admins control invites, settings and deletion; staff do the work. Every action carries the name of the person who took it.

09

Reminders that chase for you

Reminders run on their own until every document is in: by email to your client when we sent the link, a nudge to you when you sent it yourself. Filing season without the follow-up calls.

10

Your client list, yours to take

Every client your firm holds consent for, in one file, any time you want it. And when a client leaves, everything held on them exports as one file, and can be erased with the proof of erasure kept.

11

A record for when someone asks

Every notice shown, consent given, document received, viewed, downloaded, kept or deleted, on a record that cannot be quietly changed. When a client, a counterparty or the Board asks, you show the record for that request.

12

Kept for as long as the law says, then gone

Set the retention when you build the request: for the length of the engagement, then a second stage for the years a law makes you keep the records, with that law named. The documents stay through both stages, delete on their own when the second ends, and a client’s withdrawal is recorded even while the statutory hold runs.

06 · YOUR TEMPLATE, READY ON DAY ONE

Your template, ready on day one.

Your account starts with a request already built for a CA practice: Client onboarding documents, with PAN, Aadhaar (masked), address proof and the client’s full legal name, the purpose and notice written, and the documents kept for as long as they’re your client. Edit what differs and send.

And when a client’s work is different, a new template takes about a minute: name it, list the documents, set the retention. Save it once, use it for every client, every year. ITR filing, GST registration, a tax notice reply: each one is a template you make once.

READY ON DAY ONEClient onboarding documents
MADE BY YOUR FIRMITR filing
MADE BY YOUR FIRMGST registration
Document requests

New request

All requests
Start from a template One secure link per client
Press 1–3 to switch
Collect documents People upload what you ask for. Consent, notice and the files live here. Record consent only You hold the documents yourself. This records the notice and the consent.
Start from 1Blank 2Client onboarding documents 3ITR filing 4GST registration
01

Who it goes to

Name plus email or phone
Full nameRajesh Kumar Email[email protected] Phone52301 48762
Saved as +91 52301 48762
Add a person Each person gets their own link. ↵ on a complete row adds the next.
02 Client onboarding documentsfor New client onboarding Change⏎ 03 4 items3 uploads · 1 written answer · all required Change⏎ 04 Kept as long as they're a clientlink open 14 days · then deleted Change⏎

What the client sees

Live
Mehta & Co. Client onboarding documents New client onboarding
PAN Card Document Aadhaar (masked) Document Address proof Document Full legal name AnswerYour documents are kept for as long as they're a client, then deleted. This link stays open for 14 days.
Ready to send 1 person gets their own link; the notice is frozen the moment you create. Press ⌘ ↵ to create
SCREEN · BUILDER ON “CLIENT ONBOARDING DOCUMENTS” WITH THE CLIENT’S LIVE PREVIEW
07 · YOUR CLIENTS’ DOCUMENTS, KEPT SAFE

Compliance is what you are buying. Security is what makes it credible.

AWS · SOC 2 · ISO 2700119.08°N 72.88°EAP-SOUTH-1 · MUMBAIDOCUMENTS · DATABASE · KEYS · BACKUPS
THE RECORD · SHA-256
18:40CONSENT GIVEN · RAJESH K.a91f
18:41DOCUMENT RECEIVED3c07
11:02VIEWED · YOUR STAFFe5d2
11:05DOWNLOADED · YOUR STAFF7b40
CHAIN INTACT
AES-256-GCMENCRYPTED AT REST · HTTPS IN TRANSIT
DOCUMENT KEY
FIRM KEY
HELD BY YOUR FIRM ONLY
PDFDOCUMENT.PDFRAJESH KUMAR
HELD BYYOU
SHARED WITHNONE
THIRD PARTIES0
THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

THE DOCUMENT

Never shared, never sold

Your clients’ documents are not shared with or sold to any third party, now or ever. The only outside services that touch anything are the ones that run the app for you: the hosting holds encrypted files it cannot open, and the mail provider carries the message, never the document.

KEY PER DOCUMENT · KEY PER FIRM

No access to anyone outside your firm

Including us: the files remain encrypted, and no panel shows them to anyone at Confidential Dispatch. Inside the firm: roles, two-factor sign-in, and every view and download recorded. When retention ends, the document’s key is destroyed, so it cannot be rebuilt from a backup.

AES-256-GCM · HTTPS

Securely sent and stored

HTTPS in transit, AES-256-GCM at rest, a key per firm and a key per document. The upload page is receive-only: once a document is sent, nobody can view or download it from there.

SHA-256 HASH CHAIN

A record that cannot be altered

Every action is on a SHA-256 hash chain, each entry tied to the one before, and the chain’s head is written daily to write-once storage. Change one entry and every later one stops matching.

MUMBAI · AP-SOUTH-1

Held in India, in Mumbai

Documents, database, keys and backups are all held in Mumbai. Nothing about your clients is stored outside India.

HOSTED ON AWS IN MUMBAI; AWS’S INFRASTRUCTURE IS SOC 2 AND ISO 27001 CERTIFIED.

Collect the DPDP-compliant way from your next filing.

Sign up and send your first request in a few minutes. Nothing to install, for you or your clients.Start free, no card required
Read our guide: DPDP for chartered accountants, explained