Question 1

What is CA Friend?

Accepted Answer

CA Friend is the AI-powered platform for Chartered Accountants and Indian businesses. It mirrors the entire workflow of a CA — Direct Tax and ITR filing, GST (GSTR-1/3B/9), accounting under Ind AS / Schedule III, and compliance for the DPDP Act 2023, ISO 27001 and SOC 2 — in one workspace, with single-entry propagation so one transaction updates every downstream return and report.

Question 2

How is CA Friend different from a generic GRC tool?

Accepted Answer

Most GRC tools are built for enterprise compliance teams of 10+ people and price accordingly. CA Friend is built for the 20–500 person Indian IT SME, with AI-drafted policies, an audit-grade acknowledgement chain, and questionnaire autofill that turns a 10-day RFP exercise into a 4-hour review. It is opinionated about ISO 27001, SOC 2, and DPDP — not a blank-canvas framework builder.

Question 3

How quickly can we get audit-ready?

Accepted Answer

In our reference scenario, a 50-person IT company published 5 AI-drafted policies in under 30 minutes, ran organisation-wide acknowledgement coverage to 90%+ within 14 days, and reached 60–70% ISO 27001 readiness in 60 days. Full ISO/SOC 2 certification still requires an external auditor, but CA Friend dramatically compresses the preparation work.

Question 4

Do I need to be technical to use CA Friend?

Accepted Answer

No. Most flows are designed for the Compliance Manager, HR/Ops lead, or founder of an SME. The AI handles the heavy lifting: pick a policy type, click "AI-draft v1", review and edit. Technical features (S3 evidence storage, SSO, API access) are available for IT teams that want them.

Question 5

Which compliance frameworks does CA Friend support?

Accepted Answer

Out of the box: ISO/IEC 27001:2022 (Annex A controls), SOC 2 (Trust Services Criteria 2017 + 2022 supplement), and India's DPDP Act 2023. Phase 4 adds GDPR, RBI IT framework, and SEBI vendor compliance. You can also map your own custom framework if you have a sector-specific requirement (HIPAA, PCI DSS, etc.).

Question 6

How does the AI Policy Generator work?

Accepted Answer

You select a policy type (Information Security, DPDP Privacy, Access Control, Incident Response, etc.) and a target framework. CA Friend uses Anthropic Claude (with prompt templates curated by Indian compliance practitioners) to generate a company-specific policy customised to your industry, employee count, and locations. You review, edit any section, and publish. Every generation is logged for audit trail.

Question 7

How does the Questionnaire Autofill save time?

Accepted Answer

When an enterprise client sends you a 100–300 question security questionnaire, you upload it, and CA Friend reads your published policies (via RAG over pgvector embeddings) to draft answers — citing the specific policy and section as source. What used to take 10–15 working days is reduced to 2–4 hours. Questions with no matching coverage are flagged red so your Compliance Manager knows where to focus.

Question 8

How does DPDP Act compliance work in CA Friend?

Accepted Answer

CA Friend ships the DPDP framework with all 8 principal obligations (lawful basis, notice, consent, legitimate uses, general fiduciary obligations, children's data, significant data fiduciary, data principal rights). Each obligation links to the policies, evidence, and tasks that satisfy it. As enforcement progresses through 2026–27, your readiness % updates in real time.

Question 9

Are acknowledgements actually audit-grade?

Accepted Answer

Yes. Each acknowledgement records member ID, policy version ID, timestamp, IP, user agent, and a SHA-256 hash chained to the previous acknowledgement for the organisation. Auditors can verify the chain end-to-end and confirm that no records were inserted or deleted retrospectively.

Question 10

Where is evidence stored?

Accepted Answer

On Amazon S3 (or any S3-compatible store such as Backblaze B2). Each evidence artifact is content-hashed at upload, time-stamped, and linked to the control(s) it satisfies. Pre-signed URLs are short-lived; every download is audit-logged.

Question 11

How much does CA Friend cost?

Accepted Answer

Starter ₹2,999/month (5 policy templates, 1 framework, 30 employees). Growth ₹6,499/month (unlimited AI policies, acknowledgements, questionnaire autofill, up to 100 employees). Enterprise ₹14,999/month (custom frameworks, audit portal, REST API, up to 500 employees). CA Partner ₹1,499/client (white-label multi-tenant for accounting/compliance firms).

Question 12

Is there a ROI calculation?

Accepted Answer

Yes. A typical 50-person IT services company spends roughly ₹5.3 lakhs/year on compliance: ₹45,000 per security questionnaire (staff time), ₹2.2 lakh per ISO consultant engagement (twice yearly), ₹30,000 in ad-hoc policy drafting. CA Friend at ₹6,499/month (Growth) costs ₹77,988/year — a saving of ~₹4.5 lakhs and a 480% ROI. The platform pays for itself in a single questionnaire.

Question 13

How is tenant data isolated?

Accepted Answer

Multi-tenant isolation is enforced at three layers: (1) every database table has organizationId; (2) Postgres Row-Level Security policies refuse cross-tenant queries; (3) API middleware validates role + tenant + resource ownership on every request. JWTs carry organisation context, and operations are denied if the URL slug does not match the JWT claim.

Question 14

What security features does CA Friend itself implement?

Accepted Answer

JWT auth with rotating refresh tokens, password-age validation, account lockout, HIBP password breach check on signup, TOTP MFA + Email 2FA, trusted-device verification for super admins, Arcjet rate limiting + bot detection at the edge, Helmet with strict CSP/HSTS, Argon2 password hashing, audit logging of every compliance-relevant action, and a fail-closed mode when Redis is unavailable.

Question 15

Where is data hosted?

Accepted Answer

Default region is Mumbai (ap-south-1) for all India SME customers. Enterprise tier customers can request alternate regions. Backups use pg_dump custom-format dumps with encryption at rest in S3.

CA Friend FAQ

Frequently Asked Questions

What is CA Friend?

How is CA Friend different from a generic GRC tool?

How quickly can we get audit-ready?

Do I need to be technical to use CA Friend?

Which compliance frameworks does CA Friend support?

How does the AI Policy Generator work?

How does the Questionnaire Autofill save time?

How does DPDP Act compliance work in CA Friend?

Are acknowledgements actually audit-grade?

Where is evidence stored?

How much does CA Friend cost?

Is there a ROI calculation?

How is tenant data isolated?

What security features does CA Friend itself implement?

Where is data hosted?

Still have questions?

CA Friend FAQ

Frequently Asked Questions

What is CA Friend?

How is CA Friend different from a generic GRC tool?

How quickly can we get audit-ready?

Do I need to be technical to use CA Friend?

Which compliance frameworks does CA Friend support?

How does the AI Policy Generator work?

How does the Questionnaire Autofill save time?

How does DPDP Act compliance work in CA Friend?

Are acknowledgements actually audit-grade?

Where is evidence stored?

How much does CA Friend cost?

Is there a ROI calculation?

How is tenant data isolated?

What security features does CA Friend itself implement?

Where is data hosted?

Still have questions?