Encrypted in transit
The application enforces HTTPS with HTTP Strict Transport Security, and session cookies are marked secure.
Data security
Your clients trust you. You can trust this.
Here is exactly how CA Manage protects firm and client data — stated plainly, without badges we haven't earned.
Controls
Security built into the product.
Firm-level isolation
Every record belongs to a firm, and every request is scoped to the signed-in user's firm.
Role-based access
Five internal role levels plus a client role. Staff see what their role needs; clients see only their own records.
Scanned before served
Uploads enter quarantine and cannot be downloaded until a malware scan marks them clean. If a scan fails, the file stays locked.
Audit trails
Invoice, payment, document and firm-account events are recorded with who did what and when.
Revocable sessions
A user can sign out of every device at once; all of their existing sessions end immediately.
AI features
AI that knows its place.
The AI assistant uses Google Gemini. Its output is always a draft for a qualified professional to review — it never files, sends or changes anything on its own.
- Suggestions, not actionsNothing the assistant produces is acted on without a person.
- Errors kept cleanProvider errors are sanitised so credentials never appear in messages.
Questions
Ask us anything about security.
Where is our data hosted?
On managed cloud infrastructure. For current hosting region and sub-processor details, write to hello@camanage.in.
Who owns the client data we enter?
You do. See our Privacy Policy for how we handle it.
How do I report a security issue?
Email hello@camanage.in with “Security” in the subject. Please include steps to reproduce.
Run your next filing season on CA Manage.
Register your firm in a few minutes. New firms start on a 14-day trial, and a free plan is available after it.