How Blackbird Finance keeps your data safe and your files right

I’m Arhaan Rahil Mohammed, co-founder and chief technology officer of Blackbird Finance. I lead the technology: the app, how it keeps your data safe, and the files it prepares for you. I build it with Mahesh Bal, Saharsh Keerthi and Satwik Reddy.

When you put your invoices, payments and tax into an app, you are trusting it twice. First, that nobody else will ever see them. Second, that what it prepares, a GSTR-1 file or an EDF, will be accepted when you hand it in. Getting either wrong costs real money, so both are built in from the start rather than added later.

• Sign-up is confirmed with a 6-digit code sent to your email, so every account belongs to an address someone controls.
• You can turn on two-factor sign-in with an authenticator app in Settings. With it on, a password alone is not enough to get in.
• Blackbird Finance will never ask for your password or a sign-in code, by email or any other way.

Every table in the database records the account each row belongs to, and row-level security is enforced by the database itself on every read and write. Even a request that went wrong could only ever reach that account’s own rows. We test this directly, by trying to read one account’s data while signed in as another, and it is refused.

When you connect a service such as PayPal or Binance, Blackbird Finance has to store the credentials to sync for you. They are encrypted with AES-256 before they are saved, and decrypted on the server only when a sync runs.

We collect only what the features need. The privacy notice lists every kind of data, why it is held and who processes it, as the Digital Personal Data Protection Act, 2023 requires.

A GSTR-1 file the portal rejects is worse than none. Blackbird Finance checks the file before you download it, against the rules the portal applies:

• invoice numbers of up to 16 characters, using only the symbols Rule 46 of the CGST Rules allows;
• GSTINs checked against their check character, so a mistyped one is caught on screen rather than by the portal;
• GST rates the portal recognises, and units of quantity from its list;
• no empty sections, which the portal treats as an invalid file.

Exports go into table 6A, with the shipping-bill fields left out because services have none. Our guide to exports in GSTR-1 explains each field.

You can download everything from Settings at any time. If you close your account, we keep your data for 30 days so you can still download it, then erase it, unless the law requires us to keep it longer. Requests about your data are answered within 90 days, as the DPDP Rules, 2025 allow, and usually much sooner.

If you find a security problem, or want to know more about how something works, write to support@blackbirdfinance.net. We read every message.

Who is the CTO of Blackbird Finance?

Arhaan Rahil Mohammed is the co-founder and chief technology officer of Blackbird Finance, responsible for the app, its security and the files it prepares.

Can another Blackbird Finance user see my data?

No. Every table is locked to its account with row-level security enforced by the database, so a request can only ever reach your own rows.