Where your money actually sits, in plain words.

We are allowed to advise you and to place orders on your instruction. We are not allowed to hold your money, and we have not built the plumbing to do it even if we wanted to. Your rupees travel from your bank account to a fund house; the units that come back are registered against your PAN. If everyone at Stackwealth vanished tonight, your investments would still be yours, in your name, and reachable without us.

Client funds held by Stackwealth: ₹0
Pooled or nodal accounts operated: 0
Client records held outside India: 0
Reportable security incidents since 2019: 1

Who we are, on paper

Everything here can be checked against the SEBI intermediary register and the MCA filings, and you should check it before you send anyone money.

SEBI Investment Adviser registration: INA200018472
Registered as: Non-individual investment adviser, valid until suspended or cancelled
BASL membership: BASL-1794
Corporate identity number: U67190TN2018PTC126441
Execution partner (broking): SEBI INZ000217334 · NSE and BSE cash segment · CDSL depository participant
Principal officer: Aravind Sekar — NISM Series X-A and X-B certified
Compliance and grievance officer: Meera Balasubramanian — grievances@stackwealth.in
Registered office: Module 7, Tidel Park, Taramani, Chennai 600113

Custody and client funds

The single most important thing on this page: segregation is not a policy we wrote, it is the shape of the company.

Your money never enters a Stackwealth account: Every instalment goes from your bank account to the asset management company's collection account, or to the clearing corporation for an exchange-traded fund. We hold no pooled client account, no nodal account and no client float, so there is no balance of yours for us to hold, invest, lend or lose.
Units are registered to you: Mutual fund folios sit against your PAN with CAMS or KFintech. Gold ETF units sit in a CDSL demat account opened in your name through our execution partner. You can log in to either registrar directly, today, without telling us.
We hold a mandate, not your assets: The authorisation you sign lets us advise you and place orders on your instruction. It does not let us move money to any account other than the bank account you registered, and it cannot be used to change that account.
Redemptions go one way only: Proceeds return to the bank account the money came from, verified by a penny-drop against your name. Adding a new bank account takes a fresh verification and a 24-hour cooling period before it can receive anything.

Getting into your account

Most losses in this industry start with someone talking a customer into an OTP, not with a breached database.

Two-factor sign-in: A TOTP authenticator app or a passkey. SMS is offered only as a fallback and cannot be the sole factor on an account that holds a mandate.
Device binding: A new device must be approved from an already trusted one, or by re-running video KYC. Sessions expire after 30 minutes idle and 12 hours absolute.
Transaction PIN: A separate six-digit PIN, never the sign-in credential, is required to start, change or cancel a mandate and to place a redemption.
What we will never ask: Nobody from Stackwealth will ask for your PIN, an OTP, your net banking password or remote access to your screen. Our staff cannot see any of these.

Encryption and infrastructure

Standard, boring, and worth stating precisely so you can compare us with anyone else.

In transit: TLS 1.3 only, HSTS preloaded, certificate transparency monitored. No mixed content and no third-party analytics on any signed-in page.
At rest: AES-256 on every database volume and backup. Keys are held in a managed HSM with quarterly rotation and a two-person rule for export.
Personal data: PAN, bank account and Aadhaar reference numbers are tokenised; the raw values live in a separate vault with per-field access logging. Card details are never stored because we never take a card payment.
Where it runs: In Indian data centres (Mumbai primary, Hyderabad standby), with all client records retained in India as SEBI requires.
Who can reach production: Eleven engineers, each with hardware-key authentication and a named approver. Every production query against client data is logged and reviewed weekly by compliance.

Who checks, and how often

Review	Cadence	By whom	Most recent
System and cyber-security audit	Annual	CERT-In empanelled auditor	Completed 14 February 2026
Investment adviser compliance audit	Annual, mandated by SEBI	Raghavan & Iyer, Chartered Accountants, Chennai	Completed 22 May 2026
Penetration test, web and mobile	Twice a year	External red team, rotated every two years	Completed 9 July 2026
SOC 2 Type II	Annual	Independent assurance practice	Period ended 31 March 2026
Business continuity and restore drill	Quarterly	Internal, observed by compliance	Completed 5 August 2026

Audit reports are summarised in the annual disclosure document sent to every client each June, and the full reports are available to a client on request.

If Stackwealth shuts down

Companies close. Ours could. Because nothing of yours is on our balance sheet, a shutdown is an inconvenience rather than a loss, and this is what it would look like.

Your holdings: Unaffected. Folios stay with CAMS and KFintech, demat units stay with CDSL, all against your PAN. You transact directly with them from the next working day.
Your SIPs: The mandate is on your bank account, so you cancel or continue it yourself. Instalments already placed still buy units in your name.
Your data: SEBI requires us to hold client records for five years and to hand you a complete export. We publish that export monthly anyway — statements, transaction history and the rationale behind every recommendation, as a CSV and a PDF.
Our obligation: Ninety days' written notice to every client and to SEBI, an orderly transfer of advisory records to a successor adviser you choose, and a pro-rata refund of the fee you have already paid.
What you would lose: The advice, the rebalancing and the app. Not the portfolio.

If something goes wrong

Write to support
support@stackwealth.in
First response within 24 hours
Escalate to the grievance officer
grievances@stackwealth.in — Meera Balasubramanian
Resolved or explained within 7 working days
Take it to SEBI
scores.sebi.gov.in — the SCORES portal
SEBI tracks the complaint and our response
Online dispute resolution
smartodr.in
Conciliation, then arbitration if it is still unresolved

If you have found a vulnerability

Write to security@stackwealth.in, encrypted if you like — the PGP fingerprint is published at stackwealth.in/.well-known/security.txt. We acknowledge within one working day, agree a fix window with you, and will not involve a lawyer over a good-faith report.

Acknowledgement: 1 working day
Triage and severity: 3 working days
Public disclosure window: 90 days, negotiable
Bounty range: ₹5,000 to ₹2,00,000

Now look at the numbers

The simulator shows the full range of outcomes for a monthly instalment, including the tenth percentile that most projections quietly leave out.

Back to the home page Run the simulation