AI & your data.

1. The short version

• The AI is Anthropic's Claude, used over Anthropic's commercial API. We do not run our own language model and we do not use any other LLM provider.
• AI is off until an administrator turns it on, and nothing is sent on a schedule. A request leaves our servers only when someone in your team uses an AI feature.
• Your data is not used to train any model. Anthropic's commercial terms say so in one sentence, quoted in full in section 4.
• Anthropic deletes prompts and answers within 30 days. Exceptions in section 5.
• Your books live on our own server in Mumbai, India; uploaded documents on Cloudinary; call recordings on Cloudflare R2.
• They are not encrypted at rest, and we say exactly what that means in section 8 instead of calling it enterprise-grade something.
• You can export your whole company to a file yourself, any time, from Settings → Backup. You do not need to ask us.

2. Which AI provider

Anthropic — the Claude family of models — reached over their commercial API at api.anthropic.com. The default model today is claude-sonnet-4-6. We may move to a newer Claude model as Anthropic releases them; the provider and the terms in section 4 stay the same, and we will change the model name on this page when we change it in the product.

The ML parts that are not a language model — demand forecasting and anomaly scoring — run on our own servers using ML.NET. Those never leave our infrastructure and never reach Anthropic.

3. What is sent, and when

Nothing is sent in the background. Each row below is a user action: somebody types, clicks or uploads, and that is the moment a request goes out.

We never send passwords, payment card data or your API keys to the AI provider. Cards are handled by Razorpay and never touch our servers in the first place.

4. Training — the actual clause

We are not asking you to take our word for it. Anthropic's Commercial Terms of Service say:

“Anthropic may not train models on Customer Content from Services.”

“Customer Content” there covers both what is submitted (your prompts and the records attached to them) and what comes back. Anthropic's own documentation states it the same way: “We do not use API data for training (unless you have an agreement with us that states otherwise)”. We have no such agreement, and we will not enter one.

Read it yourself: Anthropic Commercial Terms of Service · Data Processing Addendum. Both checked on 20 October 2026.

5. How long the provider keeps it

• 30 days. Anthropic automatically deletes API inputs and outputs from its backend within 30 days of receipt or generation.
• Up to 2 years for inputs and outputs that its automated systems flag as a possible Usage Policy violation, and up to 7 years for the trust-and-safety classification score on such a request.
• Longer where the law requires it.

Source: Anthropic — how long do you store personal data, checked 20 October 2026. Anthropic is a United States company and processes these requests there; this is listed in our privacy policy's sub-processor table.

6. Using your own AI key

If you would rather your AI usage sat on your own account with Anthropic rather than ours, you can paste your own Anthropic API key into Settings → Integrations. Jupeak One then calls Anthropic with your key, you are Anthropic's customer for those requests, you see them in your own Anthropic console, and we never bill you for AI tokens. Nothing else about the product changes. Ask support to switch your account to that mode.

7. Where your data is stored

Every account is isolated at the database level: a query from one company physically cannot return another company's rows. The full sub-processor list, including WhatsApp and email delivery, is in the privacy policy.

Where that server is: a dedicated Windows Server 2022 machine in a Mumbai, Maharashtra datacentre, on network operated by Absolute Networks Pvt Ltd (AS146859). Your books do not leave India. The one thing that does is an AI request, which goes to Anthropic in the United States and is deleted there within 30 days — sections 3 to 5 above. Documents you upload sit with Cloudinary and call recordings with Cloudflare, both of which may store outside India; that is listed in the privacy policy.

8. Encryption — including what is not encrypted

We checked this on the production server on 20 October 2026 rather than describing what we assumed. One of the answers is not flattering, so it is here in full.

Encrypted

• In transit, to you: everything between your browser or phone and Jupeak One runs over HTTPS/TLS. So does every call we make out to Anthropic, Cloudinary, Cloudflare, Razorpay and WhatsApp.
• In transit, app to database: encrypted. Every one of the application's live database connections reports TLS. The certificate on that hop is not validated by the client, so it is encrypted but not authenticated — a change we intend to make.
• Passwords: stored hashed and salted. Nobody at Jupeak can read them, including us.

Not encrypted

• The database files at rest are not encrypted. Transparent Data Encryption is off, and the edition of SQL Server we run does not offer it; the disk itself is not encrypted either.
• The nightly database backup files are not encrypted, and no backup this server has ever taken was.

What protects that data today is access control, not cryptography: a dedicated database login with rights to this one database, no public file access to the backup directory, database-level isolation between accounts, and an audit trail. That is a real control and it is not the same thing as encryption at rest, so we are not going to call it that. Moving to an edition and a disk configuration that support encryption at rest, and encrypting the backup files, are on the roadmap. We would rather you knew the position and could weigh it than read “enterprise-grade encryption” and assume.

If encryption at rest is a requirement for you — a tender condition, an auditor, a customer of yours — tell us before you buy and we will tell you honestly whether and when we can meet it.

9. Backups

There are two different things called “backup” and it matters which one you mean.

Your company backup — you control this

• A complete logical export of one company's books: every table, as a ZIP of NDJSON files, with the row count per table recorded on the job.
• Run it on demand, or schedule it daily, weekly or monthly at an hour you pick in IST, keeping however many archives you choose.
• Restoring one is an import into an empty company — never an overwrite. Jupeak One is multi-tenant on a shared database, so “roll the database back” would roll back every other customer too. We will not offer that, and you should be suspicious of any multi-tenant vendor who says they will.
• It needs the backup.manage permission, which is denied by default and normally held only by an administrator.

Our server backups — we control these

• A full backup of the whole database runs automatically every night at about 02:00 IST. Checked on 20 October 2026: it had run every night without a gap for the previous three months.
• It is a disaster-recovery copy. It is never used to serve one customer's data to another.
• The backup files are not encrypted — see section 8.
• Data you delete can persist in them for up to a further 90 days before they rotate out. This is stated in the privacy policy.

Two honest limits on that. The nightly backup is a point-in-time copy from 02:00, so it is a recovery position measured in hours, not seconds — your own company backup from section 10 is the one you control and can take whenever you like. And an untested backup is a hope rather than a backup, so if you need to see a restore test on paper, ask us and we will arrange one rather than wave the schedule at you.

10. Exporting everything

You do not have to ask us, and there is no exit fee.

• Whole company: Settings → Backup → run a backup. You get a ZIP of NDJSON covering every table, downloadable from the job list.
• Into Tally: Tools → Tally Export produces a file Tally can import.
• Spreadsheets: every register and report exports to CSV or Excel, and the import templates round-trip, so the file you export is the shape you can import.
• By API: on plans that include the REST API, you can pull your own data programmatically.

11. Deleting everything

Ask us, from the email address on the account, and we will close it. After that:

• We hold your data for 90 days so you can change your mind and export it, then delete or irreversibly anonymise it.
• Invoices, payments and tax records are kept for eight financial years because Indian law requires it. That applies even after everything else is gone.
• Residual copies can survive in backups for up to a further 90 days before those rotate out.
• Anything already sent to the AI provider is deleted by them on the 30-day cycle in section 5 — closing your account does not need to trigger that.

Your rights under the Digital Personal Data Protection Act, 2023, and how to escalate to the Data Protection Board of India, are in the privacy policy. Complaints go to our grievance officer.

Closing an account is handled by a person, not a button — you email us and we do it. There is no self-serve erase button today, and we are not going to pretend otherwise. What is fixed is what happens afterwards: the 90 days, the eight financial years for tax records, and the backup rotation above.

12. What AI will get wrong

Said plainly, because the rest of this page is no use if we oversell this part:

• AI output can be wrong, and wrong confidently. It drafts, summarises and finds things. It is not accounting, tax or legal advice.
• Check anything that matters before you act on it — a figure in a return, a number in a reminder you are about to send a customer.
• A forecast is a forecast. It is built from your own history and will be wrong when next month does not look like last year.
• Where the AI gives you a figure, it cites the records it used, so you can check it rather than trust it.

13. Ask us anything

If your IT or compliance team needs something this page does not answer — a signed DPA, a security questionnaire, the sub-processor list in a form you can file — ask and we will answer in writing. We would rather have the conversation than have you guess.