What we collect, and what we do with it.
Written to be read. If a sentence here is unclear, that is our mistake, so tell us.
Draft for review. This page has not been checked by a lawyer yet and does not name the legal entity behind Kosh.
The short version
A firm’s client data belongs to the firm.
Workpapers rest in the firm’s own SharePoint.
We sell nothing and show no advertising.
Ask what we hold about you, at any time.
Who this is for
This page covers two groups: people at a CA firm who sign in to Kosh, and visitors to this website.
It does not cover a firm’s clients. Their information belongs to the firm, and Kosh handles it only to run TACT for that firm.
What we collect
- From your Microsoft account when you sign in: your name, your work email address and the account identifier Microsoft issues for you.
- Also at sign-in: a Microsoft permission that lets Kosh act in your name. It saves a paper you upload with you as its author, looks up colleagues in your firm’s directory, and can send invitations and reminders from your mailbox.
- From your work in TACT: what you enter, and each submission and sign-off with your name and the time.
- From this website: page views and loading speed, measured with Vercel’s analytics.
- From crashes: an error report, with email addresses and the folder paths inside SharePoint links stripped out before it is sent.
Why we collect it
To let the right people into the right engagements, to show who did what on an audit file, and to find and fix faults.
We do not sell personal information and we show no advertising.
Where it is kept
Workpapers rest in the firm’s own SharePoint. The records Kosh holds rest in a database in Mumbai, and pass through an application server in Singapore while a request is served.
Kosh keeps you signed in using storage in your own browser. It sets no advertising or tracking cookies.
Who else handles it
- Microsoft: sign-in, and file storage inside the firm’s own tenant.
- Supabase: the database and sign-in sessions, in Mumbai.
- Render: the application server, in Singapore.
- Vercel: this website and its analytics.
- Sentry: crash reports.
How long we keep it
For as long as your firm uses Kosh.
SQC 1 asks a firm to keep audit documentation for at least seven years from the date of the audit report. Your workpapers live in your own SharePoint, so your retention policy governs them, and they stay with you if you stop using Kosh.
Your choices
You can ask what we hold about you, ask us to correct it, or ask us to remove it. If you are on a firm’s team, your firm’s Partner or Admin manages your seat, so start with them.
Sign-offs and audit trail entries are part of the firm’s audit record, so they stay with that record.
Changes to this page
When this page changes, the date beside it changes too.
See it on a real audit file.
The demo opens without an account.