Trust Center
Trust in a financial tool has to be earned structurally, not asserted. This page states what we do — and, where it matters more, what we deliberately cannot do.
Privacy by architecture
Every calculation executes in your browser. There is no calculation API, no database, and no account system — your salary, rent, and investment figures cannot reach us, because no code path exists to send them. Report exports (PDF, Excel, CSV, JSON) are generated on your device. The only data we process is standard hosting access logs (via Vercel) and any email you choose to send. Details in the Privacy Policy.
Security posture
Served exclusively over HTTPS with HSTS; hardened response headers including a Content-Security-Policy, X-Content-Type-Options: nosniff, frame-ancestors 'none' (no embedding), a strict Referrer-Policy, and a restrictive Permissions-Policy. No third-party scripts, trackers, or ad networks run on this Site. The formula engine that powers configurable rules uses a purpose-built parser — never eval(). Dependencies are audited in continuous integration on every change, and the full quality gate (typecheck, lint, 255+ automated tests, build, route smoke checks) must pass before any deploy.
Accuracy & sources
Calculations are based on official government information where applicable — the Income-tax Act, 1961 as amended by each year's Finance Act, the EPF Act, the Payment of Gratuity Act, and Article 276 — encoded as versioned configuration and verified in our test suite against hand-computed statutory examples (rebate marginal relief, surcharge marginal relief at every band, the 80C umbrella, least-of-three HRA). Every result displays its full computation sheet. Figures should still be verified against the latest government publications (incometax.gov.in) before being relied upon — see the Disclaimer and Sources & references.
Responsible disclosure
Found a security issue? Email contact@anits.in with "SECURITY" in the subject. We acknowledge reports within 72 hours, will not pursue good-faith researchers, and credit fixes on request. Please avoid accessing data that isn't yours and give us reasonable time to remediate before public disclosure. The policy also ships as SECURITY.md in our repository.