Check in with a selfie
Photo and location, one record per person per day. Salary calculated from it, with paid holidays credited automatically.
Practice management for CA firms
Describe a client once — the software works out every statutory filing they owe, when it is due, who is doing it, and what it earns you.
The problem
A firm with two hundred clients is tracking well over a thousand filings a year. GSTR-1 on the 11th. GSTR-3B on the 20th — unless the client is on QRMP, when it moves to the 22nd after quarter-end. TDS quarterly, but Q4 lags two months, not one. ITR on 31 July, or 31 October if a tax audit applies.
Most firms run this on a spreadsheet and someone's memory. This runs it on rules.
The compliance engine
There is no screen for creating a filing by hand. You fill in what kind of business the client is, and the obligations appear — correctly dated, for months ahead.
Change the client from QRMP to regular monthly and the calendar rebuilds itself. Tick tax audit applicable and the ITR date moves from July to October. Add a custom obligation type your firm tracks and it joins the rotation.
The filing pipeline
Not just done or not done. You can see exactly where a return is stuck, and hand it to someone else without losing the thread.
Waiting on the client. Chase list writes itself.
In hand, not yet entered. Checklist per filing.
Booked in Tally or Busy, ready to file.
The real bottleneck, finally visible.
Closed — and the fee is raised automatically.
Overdue is never stored, only calculated. A stored flag goes stale; a calculated one cannot lie to you.
Billing & ledger
Set a fee per service on each client. Marking a return filed raises the charge — no separate billing run, no forgotten invoice.
Return marked filed. Charge posted against the client automatically.
Cash or UPI. Credits the client ledger and the firm's cash book at once.
Built from unbilled charges. Sequential number, UPI QR code on the print.
Every client with a balance, bucketed by how long it has been owed.
A filing can be un-marked and re-marked while correcting a mistake. The fee is still raised exactly once — guarded by a locked flag and a database constraint that holds even under simultaneous requests.
GSTR-1 and GSTR-3B bill together as one GST fee. AOC-4, MGT-7, ADT-1 and DIR-3 KYC bill together as one ROC fee. Nine filings, two charges.
The rest of the office
Photo and location, one record per person per day. Salary calculated from it, with paid holidays credited automatically.
Daily, weekly or one-off, assigned to a staff member. A daily task resets itself each day without any scheduled job.
KYC, PAN, bank details, registration documents with expiry dates, and an append-only log of every call and meeting.
Keep client portal credentials on file so any staff member can file. Stored encrypted, never shown in listings.
Staff and clients belong to a branch. Owners see everything; staff see their own work.
Add obligations beyond the built-in eleven — manual, or auto-generating on your own schedule.
Built carefully
Because they have genuinely different jobs — and treating them the same would be a mistake in one direction or the other.
Hashed with bcrypt. Nobody, including the firm, can read a staff member's password back. It never needs to be read — only checked.
Forgotten ones are replaced, never recovered: the owner sets a new one from the Team page, or a one-time link goes out by email and stops working after 30 minutes.
Encrypted with AES-256-GCM, because the firm genuinely must read
them back to file on the client's behalf. Authenticated encryption, so a
tampered value is detected rather than silently producing garbage.
The key lives outside the server entirely. Without it the stored passwords are unreadable — by anyone.
Tenant isolation is enforced in a single place, applied to every record type — not repeated in each route where it could be forgotten. A query that somehow runs without a firm attached fails loudly rather than quietly returning someone else's clients.
Owners set a separate confirmation password, distinct from their login, before a client or staff member can be removed. Getting into the app and destroying records in it are two different acts.
Running today
No third party holding your clients' data. One server, your database, your domain — with daily backups and a restore that has actually been tested.
Log in to BizBytes Professionals