Sensitive credentials
Broker login passwords are never collected. Broker API keys and secrets, client codes, the Angel One MPIN, a TOTP secret (only with your consent) and broker session tokens are encrypted server-side and never shown again.
Data minimisation and strict account isolation.
KAVIX is designed to process only what is needed for the service and to keep broker secrets out of customer-facing surfaces.
Isolation
Every account read and mutation must enforce user and tenant ownership.
Retention and access
Operational and audit data follow documented retention and access controls.
DATA MINIMISATION
Use only the information required to deliver the service.
KAVIX applies account and tenant ownership checks, encrypts broker tokens server-side and keeps secrets out of web, Android, logs and support displays.
Create your secure account- 01Collect only necessary account information
- 02Encrypt broker keys and tokens
- 03Restrict access by identity and role
- 04Retain security and audit evidence safely
GOOD TO KNOW
Before you continue
Does KAVIX store my broker password?+
No. KAVIX never collects your broker login password. If you connect your own broker app, the API keys, client code, Angel One MPIN and (only with your consent) TOTP secret you enter are stored encrypted, never shown again, and deleted when you disconnect or delete your account.
Can another customer see my broker data?+
No. Repository, service and API access are user and tenant scoped.
KAVIX INDIA
One clear next step.
Explore the product safely. Real broker data appears only after official authorization; paper activity always remains labelled.
1. Data we process
We may process account identity, authentication events, product preferences, risk settings, support history, device/security metadata and broker-authorized account data needed to provide requested features.
2. Broker credentials
KAVIX never asks for your broker login password. If you connect a broker through your own developer app, KAVIX collects what that broker’s official API needs: the API key and API secret (Zerodha, Upstox), your client code (Angel One) or client ID (Dhan), your Angel One MPIN, a Dhan access token you paste and, only if you tick the consent box, your Angel One TOTP secret. The 6-digit TOTP code you type for a daily Angel One login is used for that login and is not stored. After a broker login, the session tokens the broker issues are stored too. If you connect Upstox through the KAVIX Upstox login, you sign in on Upstox’s own page and KAVIX receives only the access token Upstox issues.
3. How broker credentials are protected and used
Broker credentials and tokens are encrypted at rest with AES-256-GCM, using a server key kept outside the database, and each stored record is bound to your account and that broker connection. The KAVIX app and API never show them back: the API key and client code appear only masked to their last four characters, and the other values only as saved. They are used only to sign in to and call your broker’s official API when you ask, or when a feature you switched on (such as Autopilot) acts on your instruction. They are deleted when you disconnect the broker, and when you request account deletion.
4. Purpose and access
Data is used for authentication, product delivery, security, reconciliation, support, compliance and immutable audit evidence. Access is restricted by user, tenant, role and operational need.
5. Sharing and processors
Necessary infrastructure, email and broker providers may process limited data to deliver the service. KAVIX does not sell broker credentials or present customer financial data to another tenant.
6. Retention and security
Records are retained only for operational, security, audit and legal requirements. Encryption, redaction, access controls, backups and monitoring reduce risk but no system can promise absolute security.
7. Your choices
You may request access or correction through info@kavixai.online. You can disconnect a broker at any time from the Broker page. You can delete your account in the app (Profile, then Delete account) or at kavixai.online/delete-account. Some immutable audit, fraud-prevention or legally required records may need to be retained.
Delete your account
Delete your KAVIX account in the app (Profile, then Delete account) or, without signing in, on the account deletion page. It lists what is deleted and what is retained.