You're about to point a tool at your bank. Here's exactly what it can do.
Only statements that are true today. Nothing on this page is aspirational.
No signup, no card. Real data, full product.
Read-only by default
CFOOS reads. It does not move money, place orders, or issue refunds.
Credentials encrypted at rest
Per connection, with a key that never leaves the server.
Role-based access on every route
Seven roles, enforced on all ~90 API endpoints — not per-handler decoration that someone can forget.
Append-only audit log
Every action that touches money is recorded, including every refused one.
Multi-tenant isolation
Every query is scoped by organisation by construction.
Bank access via Account Aggregator (Setu)
The RBI-regulated consent framework. You grant consent; you revoke it.
Your data stays yours
Exportable at any time, and deletable on request.
We're not SOC 2 certified yet.
We'd rather tell you that than show you a badge we haven't earned. The same rule that governs our numbers governs our claims: if we can't evidence it, we don't say it.
See it with real data before you connect anything.
The demo is a full product with a real brand's numbers in it. No signup, no card.