We operate with
nothing to hide.
Reach Financials is built on a foundation of regulatory compliance, data integrity, and operational transparency. This page is our public commitment — updated in real time — to the standards we hold ourselves to.
Regulatory Licenses
Licensed across every domain we operate in
We don't operate on exemptions or grey areas. Every product Reach offers is backed by the appropriate regulatory license, renewed annually and subject to ongoing supervisory oversight from India's top financial regulators.
| Regulator | License Type | Registration No. | Valid Until | Status |
|---|---|---|---|---|
| SEBI | Investment Adviser | INH000XXXXXX |
March 2026 | ● Active |
| IRDAI | Composite Insurance Broker | IB-XXXXX/XX |
September 2026 | ● Active |
| RBI | Account Aggregator NBFC | N-14.03627 |
Perpetual | ● Active |
| AMFI | Mutual Fund Distributor | ARN-XXXXXX |
December 2025 (renewal filed) | ● Renewal Pending |
| PFRDA | Point of Presence — NPS | POP-XXXXXXXXX |
June 2026 | ● Active |
| NSDL | Depository Participant | IN-DP-XXXXX-20XX |
Perpetual | ● Active |
Data Protection
Digital Personal Data Protection Act, 2023
India's DPDP Act represents the most significant shift in data rights for Indian citizens. Reach has been DPDP-ready since Day 1 of enforcement — not because the law requires it, but because our customers deserve it.
Data rights aren't a
compliance checkbox.
The DPDP Act gives every Indian the right to know, correct, and erase their personal data. Reach has embedded these rights into the product itself — not as a settings page buried three menus deep, but as first-class features accessible in one tap.
Your Rights as a Data Principal
- Right to access a summary of personal data we hold about you
- Right to correct or update inaccurate personal data
- Right to erasure of data no longer required for lawful purposes
- Right to grievance redressal within 30 working days
- Right to nominate a representative for data rights
- Right to withdraw consent at any time, with no penalty
- Right to know the identity of all Data Fiduciaries processing your data
Our Obligations as a Data Fiduciary
- Collect only data necessary for the stated purpose — no dark patterns
- Obtain free, specific, informed, and unambiguous consent in plain language
- Notify you within 72 hours of any personal data breach
- Appoint a Data Protection Officer (DPO) accessible to every user
- Conduct Data Protection Impact Assessments for new products
- Erase data within 30 days upon request or end of retention period
- Maintain processing records available to DPDPB on demand
Consent Framework
Reach's consent mechanism is purpose-specific. Every consent request tells you exactly:
- What data is being collected
- Why it is needed
- How long it will be retained
- Whether it will be shared with third parties
Data Localisation
All personal data of Indian residents is stored exclusively on servers located within India, hosted on AWS Mumbai (ap-south-1) and Azure Central India. No personal data is transferred to or processed in servers outside India without explicit regulatory approval and user consent.
Data Practices
What we collect, why, and for how long
No ambiguity. Every category of data we hold, the lawful basis, and the retention period — presented plainly.
| Data Category | Purpose | Lawful Basis | Retention | Shared With |
|---|---|---|---|---|
| Identity (PAN, Aadhaar) | KYC/AML, regulatory compliance | Legal obligation (PMLA, SEBI) | 10 years post account closure | RBI, SEBI, FIU-IND (on demand) |
| Bank Account Details | Payments, mandate registration | Contractual necessity | 7 years post last transaction | Payment banks, NPCI |
| Investment Portfolio | Advice, reporting, rebalancing | Explicit consent | Duration of relationship + 5 years | AMCs, depositories (on instruction) |
| Insurance Details | Policy management, claims support | Explicit consent | Policy term + 5 years | Insurers (on instruction only) |
| Device & Usage Data | Fraud prevention, product improvement | Legitimate interest | 13 months rolling | Not shared |
| Communication Data | Support, audit trail | Legitimate interest | 3 years | Not shared |
Data Minimisation
We collect only what is strictly necessary for the stated purpose. If a field is optional, we never make it mandatory through design.
Purpose Limitation
Data collected for KYC is never repurposed for marketing. Each dataset is siloed to its stated function and cannot be cross-used without fresh consent.
Storage Security
All data at rest is encrypted with AES-256. All data in transit uses TLS 1.3. Encryption keys rotate automatically every 90 days.
No Data Sales
Reach has never sold, rented, or brokered customer personal data to any third party. We earn revenue from products, not from your data.
Anonymisation
All analytics and internal research use anonymised or pseudonymised datasets. Re-identification is technically prevented at the infrastructure layer.
Vendor Due Diligence
Every third-party processor undergoes annual security audit. Data processing agreements (DPAs) are in place with all sub-processors before any data is shared.
Certifications & Standards
Third-party validated, annually renewed
Compliance claims without third-party verification are just words. Every certification below has been independently audited and is publicly verifiable.
Security Architecture
Defence-in-depth, at every layer
Security at Reach is not a product feature or a marketing claim. It is an engineering principle applied at every layer of the stack — from the customer's device to our data centre.
Encryption
AES-256 at rest. TLS 1.3 in transit. Database-level field encryption for PII. HSM-backed key management with 90-day rotation.
Identity & Access
Zero-trust access model. RBAC with least-privilege enforcement. MFA mandatory for all internal systems. PAM for privileged accounts.
Monitoring
24×7 SOC with SIEM integration. Anomaly detection on all transaction streams. Dark-web monitoring for credential exposure.
Resilience
Active-active multi-AZ deployment. RTO: 4 hours. RPO: 15 minutes. Annual DR drills with board-level sign-off.
Vulnerability Management
Continuous automated scanning. Responsible disclosure programme. Critical patches deployed within 24 hours of disclosure. No known critical vulnerabilities unpatched beyond SLA.
Bug Bounty
Public bug bounty programme on HackerOne. Scope covers all customer-facing products and APIs. Rewards up to ₹5,00,000 for critical findings.
Grievance Redressal
A complaint is a gift. We treat it that way.
Every grievance at Reach is assigned a unique ticket number, logged immutably, and escalated through a structured four-tier process. You are never left without a path forward.
In-App Support
Raise a ticket directly from the app or website. Acknowledgement within 2 business hours with a unique complaint reference number.
Nodal Officer
If unresolved at Level 1, escalate to our Nodal Officer by email or registered post. Every escalation is reviewed by a senior compliance officer.
Principal Nodal Officer
Unresolved complaints escalate automatically to the Principal Nodal Officer (PNO), who reports directly to the Board's Audit Committee.
Regulatory Redressal
Customers may approach SEBI SCORES, IRDAI IGMS, RBI Ombudsman, or the Data Protection Board depending on the nature of the complaint.
| Role | Name | Address | |
|---|---|---|---|
| Data Protection Officer | Available on request | dpo@reachfinancials.in |
DPDP compliance queries only |
| Nodal Officer | Available on request | nodal@reachfinancials.in |
Reach Financials Pvt. Ltd., Mumbai |
| Principal Nodal Officer | Available on request | pno@reachfinancials.in |
Reports to Board Audit Committee |
| Compliance Officer | Available on request | compliance@reachfinancials.in |
Regulatory filings and SEBI/IRDAI matters |
Compliance Audit Log
Our compliance history, made public
A record of significant compliance milestones, regulatory interactions, and self-disclosed incidents. We believe transparency after the fact is as important as prevention before it.
Contact & Disclosures
Reach the right person, fast
Compliance, data rights, security disclosures — every query has a dedicated point of contact with a committed response time.
Security Disclosures
Report a vulnerability through our bug bounty programme or directly to our security team.
security@reachfinancials.inData Protection Officer
Exercise your DPDP data rights, consent withdrawal, or data erasure requests.
dpo@reachfinancials.inCompliance & Legal
Regulatory correspondence, legal notices, law enforcement requests.
compliance@reachfinancials.inRegulatory Disclosures
Reach Financials Pvt. Ltd. is registered with SEBI as an Investment Adviser (Reg. No. INH000XXXXXX), IRDAI as a Composite Insurance Broker, AMFI as a Mutual Fund Distributor (ARN-XXXXXX), and is an RBI-regulated NBFC Account Aggregator. Investments in securities are subject to market risk. Past performance is not indicative of future returns. Insurance is subject to terms, conditions, and exclusions of the policy. Please read all scheme-related documents carefully before investing. Reach Financials is not a bank and does not offer deposit products. NBFC services are not covered by DICGC insurance.
This Trust Center is reviewed quarterly. Last updated: February 2026. For the most current regulatory status of any license, please verify directly with the respective regulatory authority.