Key takeaways
What this article covers, in order:
- Why is GST data more sensitive than you'd think?
- Questions about your login
- Questions about GST portal access
- Questions about your data
- Questions about leaving
- A scoring sheet you can print
Sunil was about to upload two years of invoices into a free GST app when his daughter asked a fair question: "Papa, who else can see all this?" He didn't know. Here's the honest answer. Free GST software can be every bit as safe as paid software, because price tells you nothing about security by itself. What matters is how the vendor handles your login, your GST portal access, your data and your right to leave, and you can find that out by asking 12 plain questions.
Why is GST data more sensitive than you'd think?
Think about what sits in your GST software after a year. Every customer's GSTIN. Every supplier. Monthly sales, margins, tax liability. If you import bank statements, your bank transactions too. And the software may be able to submit returns in your name.
That's a lot to hand over in a five-minute sign-up. The good news is you don't need to be technical to judge a vendor. You need the right questions, and you need to notice when an answer goes vague.
Questions about your login
1. Can I turn on two-step login? A password on its own is the weak spot in most small-business account problems. Look for a one-time code at login, by SMS, email or an authenticator app.
2. Can my CA and staff have their own logins? If three people share one password, nobody can tell who changed what. Separate users also mean you can remove someone the day they leave without changing your own password.
3. Can I limit what each person does? Your billing assistant probably shouldn't file returns. Your CA may need to file but has no reason to delete invoices. Ask whether roles exist, and on which plan.
Questions about GST portal access
4. Does anything get filed without my OTP or signature? The answer should be a flat no. Good GST software doesn't need to keep your portal password forever. Usually you authorise a filing session with an OTP sent to your registered mobile or email, and each return still needs your EVC or DSC.
5. Can I see the full return before it goes? You want to see every table of GSTR-1 and GSTR-3B, the tax payable, and any interest or late fee, before you press submit. Not a summary. The whole thing.
Questions about your data
6. Where is my data stored, and is it encrypted? Ask about encryption in transit (that padlock in your browser) and at rest (on their servers). If your clients care about data staying in India, ask which country it sits in.
7. Who at your company can see my books? Support staff sometimes need to look at an account to fix something. A decent answer explains when that happens and whether you get asked first.
8. Do you sell my data, show me ads, or train AI on it? This one matters more for free products, because you want to know how the vendor pays its bills. Read the privacy policy. If there are AI features, ask what data they use and whether it leaves your account.
9. What happens if you have a breach? Will they tell you, how fast, and how? India's Digital Personal Data Protection Act, 2023 puts obligations on businesses that handle personal data. A vendor that has thought about this will answer without fumbling.
Questions about leaving
10. Can I export my data on the free plan? Find out which reports and records you can download, in which formats, and whether exports are kept for paid users. Write down what's missing so you can work around it.
11. What happens to my data after I leave? Ask how long they keep it and whether you can ask for deletion. Also remember that GST law expects you to keep books and records for several years after the annual return due date, so you need your own copy whatever the vendor does.
12. Will the free plan still exist next year? Ask if it has an expiry date and how much notice you'd get if terms changed. Better to know before you put a year of books into it.
A scoring sheet you can print
| Question | Clear yes | Vague | No | Notes |
|---|---|---|---|---|
| 1. Two-step login | ☐ | ☐ | ☐ | |
| 2. Separate user logins | ☐ | ☐ | ☐ | |
| 3. Roles and permissions | ☐ | ☐ | ☐ | Which plan? |
| 4. Filing needs my OTP or signature | ☐ | ☐ | ☐ | |
| 5. Full preview before filing | ☐ | ☐ | ☐ | |
| 6. Encryption and storage location | ☐ | ☐ | ☐ | |
| 7. Staff access policy | ☐ | ☐ | ☐ | |
| 8. No data sale, clear AI policy | ☐ | ☐ | ☐ | |
| 9. Breach notification | ☐ | ☐ | ☐ | |
| 10. Export on the free plan | ☐ | ☐ | ☐ | What's left out? |
| 11. Retention and deletion | ☐ | ☐ | ☐ | |
| 12. Free plan permanence | ☐ | ☐ | ☐ |
A vague answer isn't automatically bad. Smaller vendors sometimes just haven't written things down. But if a vendor can't give you a straight answer on 4, 5 and 8, slow down.
Honestly, most problems start in your own shop
Vendor security is half the story. In the small businesses we see, the trouble is usually much more ordinary. A shared password on a sticky note near the billing counter. A salesman who left in Jan 2026 and still has a login in Oct 2026. An OTP forwarded on WhatsApp to "whoever is free to file it". An email that looks like a GST notice and asks you to "verify your account". One laptop with no screen lock that the whole shop uses.
You can fix nearly all of that in an afternoon. Turn on two-step login wherever it's offered. Give each person their own user, and remove them the day they leave. Treat a GST OTP like a signed cheque and don't pass it to anyone you wouldn't hand a cheque to. Open notices by logging in to gst.gov.in yourself, never through an email link. And at each quarter-end, download your key reports and keep them somewhere you control.
Does paying make it safer?
Not by itself. At most vendors, the same servers, encryption and staff rules apply to free and paid accounts. What paid plans usually add is more control: more users so nobody shares a login, finer roles, more GSTINs. So judge a vendor on its answers, not on what it charges.
How HelloBooks helps
We'd rather you ask us these 12 questions than take our word for anything, so put them to our support team and judge the replies yourself.
A few product facts that touch this checklist. HelloBooks Free includes 2 users, so your CA gets their own login in the same books instead of borrowing yours, and Pro (₹499/month) adds unlimited users and roles. GSTR-1 and GSTR-3B are filed directly to the GST portal from inside HelloBooks, and you see the return before you submit, including the GST portal's own interest and late fee figure on GSTR-3B. Your filed returns live on the GST portal under your GSTIN whatever software you use. And the free plan is ₹0 with no card and no expiry.
See what's in the free accounting software plan and how GST returns work in HelloBooks.
FAQs
Is cloud GST software less safe than desktop software?
Not inherently. Desktop software keeps data on your machine, which avoids vendor-side risk but leaves you exposed to theft, a dead hard disk or a backup nobody took. Cloud software moves that risk to the vendor. Each has trade-offs, and how well it's managed matters more than where it runs.
Should I give my GST portal password to software?
Ask the vendor how authorisation works first. Prefer software where each filing session is authorised by OTP and each return is signed by you with EVC or DSC.
Can my CA file for me safely?
Yes. Give them their own user in your software and agree in writing who signs off each return. Don't just forward OTPs on chat without that agreement.
What if I think someone misused my account?
Change your password, remove users you don't recognise, check the GST portal for filings you didn't make, and contact the vendor. If a wrong return went through, speak to a CA about how to correct it.
Does a privacy policy really matter to a small shop?
It does. Your customers' and suppliers' names, GSTINs and phone numbers are data you're responsible for, so it's worth knowing how your vendor treats them.
Ask the questions, write down the answers, and go with the vendor whose replies you'd be happy to read out to your CA.
Start free — GST filing included, no card. Try HelloBooks Free
