How we protect your PAN

A PAN is the only way a registrar lets anyone look up an IPO allotment. IPO Khata encrypts each PAN with AES-256-GCM before it is stored, with the key kept apart from the database; shows it masked in lists and in full only when you open that person’s card; never puts it in an email or notification; and sends it only to the IPO’s registrar, over an encrypted connection, to check the result. It never asks for a bank or demat login, UPI PIN or OTP, and cannot apply, move money or sell shares.

Why a PAN is needed

Registrars publish IPO allotment results only against a PAN, application number or DP and client ID. To check results for you, IPO Khata needs the PAN of each person whose applications you track.

How it is stored

Each PAN (and demat ID, if you add one) is encrypted with AES-256-GCM before it reaches the database. The key is kept separately from the database, so a copy of the database alone does not reveal PANs. Lists show the PAN masked, such as ••••••234F.

Where it goes

A PAN leaves IPO Khata only to the registrar of the IPO being checked, over HTTPS, exactly as if you typed it on the registrar’s site. It is never put in an email, a phone notification or a log line.

Your control

Settings lets you download everything held about your household, and delete your account, which removes the PANs and everything else. Family members you invite see the same household; nobody else does.

The honest limits

No online service can promise it will never be breached. IPO Khata keeps as little as it can, encrypts what is sensitive, and is run by one developer who answers for it personally.