Cookie settings

Choose what FinRace may use. You can change this at any time from “Cookie settings” at the bottom of the page.

Strictly necessary

Always on

Keep you signed in, protect your account and forms, and remember the settings you choose here, such as theme and language. The site cannot work without these.

Count visits and see which pages are used, so we can improve them. First-party and cookieless: a hash of your IP address and browser that changes every day, and an approximate city from a database on our own server. Nothing is shared with anyone else. Off unless you allow it.

Advertising and marketing

Not used. FinRace has no advertising or third-party tracking cookies.

Security & architecture

Architected for confidential client data

Self-hosted by default. Built for air-gapped deployment. DPDP-aware in design.

FinRace AI runs entirely on infrastructure you control. There are no external LLM API calls — reasoning happens on a self-hosted model — and no third-party analytics or tracking scripts anywhere in the product. It is built to run on-premise or in an air-gapped environment, and its data model is DPDP-aware: per-tenant isolation, an immutable audit log, a consent ledger, and configurable retention.

No third-party AI

Every model call is served by a self-hosted model. Confidential client tax and legal data is never sent to OpenAI, Anthropic, Google or any external AI provider. There are no analytics or tracking scripts in the product.

Built for air-gapped deployment

The platform is designed to run without outbound internet access; a hardened “sovereign mode” disables non-essential external calls. The reference cloud deployment is internet-connected — air-gapped install is a supported deployment target, not the default.

Per-tenant isolation

Row-Level Security on every table and a separate vector namespace per tenant. One firm’s documents and research history are not reachable from another’s.

Immutable audit log & retention

Every consequential action is written to an append-only audit log. Retention windows are configurable per deployment. Security-event logging happens at authentication boundaries only.

DPDP-aware design

A consent ledger records data-processing consent; the audit log and retention controls support data-principal-rights workflows. This is an architectural posture, not a compliance certification — your DPO remains the authority on your obligations.

Hallucination guard

Retrieved citations are validated against the source context or a canonical statute list before an answer renders. Ungrounded citations are flagged, not shown as fact.

We disclose real limits. There is no case-law or tribunal-precedent corpus, and no GST case-law or circular search. Some vertical capabilities (Form 3CD tax-audit drafting, BNS↔IPC concordance) are not yet available and are labelled as such in the product. “Sovereign” and “air-gapped” describe the architecture and the supported deployment model — not unconditional guarantees. Full policies.