Built so a firm's data stays a firm's data.
You are being asked to move your whole client book into someone else's software. That deserves specifics rather than adjectives, so this page describes how GrowOn is actually built — including the things it deliberately does not do.
Isolation between firms
One database, and no way across.
GrowOn is multi-tenant: many firms, one system. The separation between them is enforced by the database itself, so it holds even if application code is wrong.
Separated in the database
Every table that holds a firm's records carries row-level security, and references between records use a composite key that includes the firm. A record cannot point at another firm's row even by mistake.
Checked by a test, not by hand
An isolation check tests every rule that keeps firms apart — nine separate arms, including whether a new table or function is correctly fenced — so a control that stops working shows up as a failure rather than going quiet.
The operator plane cannot read client data
The account that runs GrowOn's own console connects as a different, restricted database role. It can see that your firm exists and how many seats it has. It cannot read your clients.
Inside your firm
Who can see what, and who did what.
Four roles, and one decision about the book
Owner, Admin, Advisor and Ops, each with a defined set of capabilities. Separately, your firm decides whether everyone sees every client or advisors and admins see only their own; owners and operations staff always see the whole book. When you restrict it, the restriction is applied across the client-linked tables in the database.
Operations staff never see the money
Net worth, income and commission are a separate capability from the client record itself. Operations staff work across the whole book and never see them — that is fixed by the role, not a switch. Commission figures sit behind a password even for administrators.
Your own password reset, and two-step sign-in
Forgot your password? Reset it yourself with a code sent to your email. Any member can add two-step sign-in with an authenticator app and one-time recovery codes, and the firm can require it for everyone. It is not tied to a plan.
History that cannot be rewritten
The task history and the audit log are append-only: an entry can be added, never edited or removed. A bulk deletion is copied to a dated archive first, kept for ninety days by default.
By design
The safest record is the one nobody has to keep.
Client records have no field for PAN, bank or address details. What GrowOn records instead is that a document was seen and verified: the status, a hash, who checked it and when. It holds no image of anyone's identity, and the registrar importer never keeps a full PAN.
No order route and no exchange login. GrowOn never places a transaction, so there is nothing of that kind to leak. You keep executing where you do today.
Your firm's registrar passwords are stored sealed, and credentials are stripped from our logs.
Your due diligence
Ask us anything, with the product open.
Everything on this page describes how GrowOn is built, and we would rather answer your questions with the software in front of us than in a brochure. Bring your IT adviser or your auditor to the demo.
If your process needs specific documentation, tell us what and we will give you a straight answer about it. Write to contact@growon.in.
No certification is claimed. This is how the product is built, and we’ll walk your auditor through it.
Bring your due-diligence questions to the demo. We'll show you the list.
We would rather answer them with the product open than in a brochure. Ask us anything about how your firm's data is held.
A person reads every message. We reply within a few hours — or call +91 86686 59793.