Terms of service, version 1.0

1. Who this agreement is between

The provider: Jaspal Singh, proprietor, trading as S.G. Works, GSTIN 03BFSPS2298A1ZA, registered address 839, Street No 5, Nirankari Mohalla, Miller Ganj, Ludhiana, Punjab 141003 ("we", "us").

The customer: the business named on the order or invoice ("you").

The service: SG Works ERP, an invoicing, purchase, inventory, accounting and GST-filing-data application, provided over the internet at https://<your-name>.sgworks.in.

2. Your data is yours

Everything you enter — your customers, your suppliers, your products, your invoices, your bills, your payments, your ledgers and your GST working — belongs to you. We do not own it, we do not sell it, we do not share it with anyone else, and we do not use it to train anything.

Under India's Digital Personal Data Protection Act 2023, the personal data in your account (your customers' and suppliers' names, phone numbers, email addresses, GSTINs and addresses) is data for which you are the Data Fiduciary. We act as your Data Processor: we hold and process it only to run this service for you, and only on your instructions.

3. Where your data lives, and on what

Your account has its own separate database. It is not mixed with any other customer's data.

• The application and your live database run on one server, rented from Vultr, in the region configured at provisioning. Our domain names are registered through Hostinger.
• Backups are stored in Amazon S3 in the Mumbai region (ap-south-1), inside India.

This is a single machine, and we are telling you that on purpose. There is no second server standing by and no automatic failover. If that machine fails, the service is unavailable until we restore it (see section 6). We have chosen a simple, single-machine design for a small number of customers rather than pretending to a resilience we do not have. If that is not acceptable for your business, tell us before you sign up rather than after.

4. How your data is protected

• Traffic between your browser and the service is encrypted (HTTPS).
• Every person who uses your account has their own username, their own password and their own role (Staff, Accountant or Admin). Passwords are stored using scrypt at the OWASP-recommended work factor and are never stored or transmitted in a form we can read back.
• Repeated failed logins are rate-limited.
• A backup of your database is taken every hour, encrypted with AES-256-GCM using a key unique to your account, and uploaded to S3. The unencrypted copy is deleted immediately, whether the upload succeeded or not.
• Once a week, automatically, we take your most recent backup, decrypt it, restore it into a fresh empty database and compare it against your live one — every table's row count, and the total debits and credits across your whole ledger. If they do not match, the check fails loudly. This runs every Sunday.

What that weekly check does not prove, stated plainly because it would be easy to imply otherwise: it reads only your newest hourly backup. It has never read back a backup from the daily, monthly or yearly tiers, and it does not prove that the server itself — as opposed to your database — can be rebuilt from scratch. See section 6.

5. Who can see your data

• You and the people you give accounts to, according to the role you give each of them.
• Our operator. Running a database means having administrative access to it. One person on our side can technically read any customer's data. We do not do so except to fix a fault you have reported, or where the law requires it.
• Nobody else.

Two honest limitations on our ability to tell you who did what:

1. The service keeps an audit trail of a limited set of actions, not of everything. Financial documents and their cancellations are recorded; many routine changes are not. If you need a complete forensic record of every action by every user, this product does not provide one today.
2. We do not currently keep web-server access logs. If you ask us "who was logged in at 2am on the 14th", we cannot answer that from records.

Both are things we intend to improve. Neither is something we will pretend we already have.

6. Availability, failure, and how long recovery takes

There is no uptime guarantee (no SLA) and we are not offering one. We aim to keep the service running during Indian business hours and to respond quickly when it is not, but we do not promise a percentage and we do not pay penalties for downtime. What we commit to instead is best-effort restoration of service, and the specific, automated things below — which are worth more to you than a percentage we could not enforce.

What runs automatically, without anyone remembering to do it:

• Your site is checked every five minutes, around the clock. An external monitoring service — one monitor per customer, independent of our server — requests your site's health endpoint and alerts us by email and on a phone app if it stops answering. It runs whether or not anyone is at a desk, and it does not depend on our server being alive to report that our server is not.
• That check is deliberately not a simple ping. The address it calls makes the application query the database on every request, so it fails if the database fails. A check against the front page alone would keep showing green while the database was down, because the front page is served from files and never touches it. We know, because that is the mistake we made when setting it up, and corrected.
• Your database is backed up every hour, encrypted before it leaves the server. If an hourly backup fails to complete, an automated alert is raised to us — we do not rely on noticing.
• Once a week, a backup is automatically restored and checked, to prove the backups are not merely present but usable. That check also raises an automated alert to us if it fails.

The alerting itself has been tested, not assumed. We deliberately pointed a monitor at a server that does not exist, confirmed the failure alert arrived, and then removed it; we have also seen a recovery notification arrive when a monitor came back. Both directions are known to work, rather than hoped to.

If we lose the server:

• How much work could be lost (RPO): up to one hour. Backups are hourly, so in the worst case the last hour of entries would need to be re-entered.
• How long recovery would take (RTO): we do not state a number, because we have not yet rehearsed a full rebuild end to end. Your database backups are verified weekly and we are confident in them. The rebuild of the server around them is documented but has not been practised. We would rather tell you that than quote a number we have not earned.
• Said plainly, because it is the sentence that matters most in this section: recovery from the total loss of the host has been designed, and tested at the component level, but has not yet been rehearsed end to end. The pieces — the encrypted backups, the weekly restore check, the documented rebuild — are each in place and each verified. What has not happened is a single drill that takes a bare machine through to a working service. Until it has, we will not put a recovery time in writing.

7. Getting your data out

What you can export yourself, from inside the product, right now, as CSV files you can open in Excel — no permission needed, no charge, no limit on how often, and you do not have to be leaving:

Each of those exports is complete. It contains every matching record you have, not the first page and not a recent slice — whether you have fifty invoices or fifty thousand.

What is NOT yet exportable by you, named in full rather than left for you to discover. Sixteen kinds of record have no self-service export:

• Money in and out: payments received, supplier payments, expenses, the cash book.
• Accounting: journal entries (your general ledger), the stock ledger, the audit trail.
• Documents: quotations, purchase orders, delivery challans, sales returns, purchase returns.
• Reference data: categories, units, transports, and your company profile.

They are your records and you can have them at any time — ask and we will send them to you as CSV, or as a PostgreSQL database dump for your next vendor, within 24 hours on a business day (a request that arrives outside business hours is answered on the next business day). There is no charge for this and you do not have to be leaving to ask.

One consequence worth knowing before you need it: the invoice and purchase exports show a Received and a Balance for each document, but the individual payments that produced those figures are in the list above. If your accountant needs to see the workings and not just the result, ask us for the payments as well.

We are building a one-click "export everything". Until it exists, this section tells you exactly where the line falls instead of implying there is none.

8. How long we keep your data after you leave

This section matters and is the one most likely to surprise you, so it is written in full.

When you stop using the service, we delete your live database and your account from our server.

Your encrypted backups in S3 cannot be deleted early. They will remain in our custody for up to seven years.

This is not a policy choice we can waive. The backup storage is configured in AWS "Object Lock — COMPLIANCE" mode with retention periods of:

In COMPLIANCE mode no one can delete those objects or shorten their retention — not us, not our administrators, not even the root account of our AWS organisation. The seven-year figure was chosen to sit safely beyond the GST record-retention period.

Practically, this means:

• Your data is safe from us deleting it by accident or in anger. That is why the setting was chosen.
• If you ask us to erase everything, we can erase your live database and we cannot erase those backups. We will tell you the date the last one expires.
• The backups are encrypted with a key unique to your account and are useless to anyone without it.

If you need a provider who can guarantee complete erasure on demand, this is not that product, and we would rather you knew now.

9. What we do if we lose your data

If we lose your data through our fault, we will restore it from the most recent good backup and tell you exactly what was lost and when. We will not hide an incident from you or discover it on your behalf.

Our financial liability is limited to the fees you paid us in the twelve months before the incident. We are a small provider and we are not in a position to underwrite your business losses. [A drafting note is not shown here.]

10. What you pay, and what happens if you stop

Your price, billing period and start date are recorded on your order and in our customer register.

• Price: [figure not shown on this public copy; it is on your order and invoice] per year, per account, plus GST.
• Payable annually in advance, by bank transfer or UPI. We issue your invoice on receipt of payment.
• No refund for the unused part of a year you have already paid for. If you stop mid-year, you keep the service to the end of that year (see section 11); we do not refund the remainder.

If payment stops, you do not lose access to your own books. Before anything changes, we will give you 30 days' notice in writing. If the account is still unsettled at the end of those 30 days, we may place it into read-only mode: you and your staff can still log in, view everything, run every report and export all of your data, but you cannot create or change records until the account is settled. The screen will say why and who to contact.

You are never locked out of your own data for not paying. Read-only is the strongest step we will take: every read is served and every write is refused with a message naming the reason. There is no state in this software in which an unpaid account cannot open its own books.

We will not take your data away from you to make you pay. That is a deliberate commitment and it is enforced in the software, not just promised here.

11. Ending the agreement

If you are ending it: you do not have to give us notice, and there is no minimum term beyond the year you have paid for. You may stop at any time by writing to the support contact in section 13. Your service runs to the end of the year you have paid for; we do not refund the unused part of it (section 10).

If we are ending it: we will give you 30 days' notice in writing, and your 90-day window below starts from the end of those 30 days, not from the day we tell you. So being asked to leave gives you 120 days in total, and the clock on getting your data out does not start until your service has actually stopped. Non-payment is handled by section 10's 30-day notice and read-only mode, not by termination.

After your service ends we keep your data for 90 days — counted from the end of your paid period if you left, or from the end of our 30 days' notice if we ended it. During those 90 days nothing is deleted and you can still ask us for it. That window exists so that leaving is never a race.

In those 90 days you can export, yourself, every record type the product can currently export: customers, suppliers, products, invoices, purchase bills, and your customer and supplier ledgers — the seven types, plus the profitability, GSTR-2B and GSTR-1 downloads listed in section 7. That list is growing, and section 7 always states the current one rather than this section repeating it. For anything not on it, ask us and we will send it (section 7); on request we will also send a full database dump for your next vendor.

At the end of the 90 days we permanently delete your live database and your account from our server. There is no charge for deletion. Section 8 governs the encrypted backups, which are on their own retention clock and which we cannot delete early — please read it, because it is the part most likely to surprise you.

We recommend exporting before your final day rather than on it.

12. Changes to these terms

If we change these terms materially we will tell you in writing at least 30 days before the change takes effect. A terms document that can change without notice is not terms.

If you do not accept a change, you may end the agreement under section 11 with no penalty, and with the same 90-day export-and-retention window. You are never held to a term you did not agree to, and you never have to choose between accepting a change and getting your data out.

This document is version-controlled: every version of it, and every change ever made to it, is recorded and can be produced on request.

13. Contact

• Email: erpsgworks@gmail.com
• WhatsApp only: 9569313131 — please do not call this number; it is not a voice support line.

We answer within 24 hours on business days. A message that arrives outside business hours is answered on the next business day.

For anything about your data specifically — a copy, a correction, a question about who can see it — use the same contacts and say so; we will answer within the same 24 hours on a business day.