Compliance & Security
Working with the DGFT
The eBRC is issued by the Directorate General of Foreign Trade. A certificate generated through ebrc.in is the same DGFT-issued eBRC, carrying the same standing, as one generated on the DGFT portal directly.
Since November 2023 the eBRC is self-certified. Your bank transmits each inward remittance to the DGFT electronically, the exporter certifies which export it relates to, and the DGFT issues against that certification. The DGFT publishes a first-party integration route for submitting such filings through software. ebrc.in operates on that route.
What ebrc.in does. Retrieves your inward remittance records from the DGFT, presents them for mapping to invoices and shipping bills, validates each filing before submission, submits it, and retains the resulting certificate and its supporting record in your account.
What ebrc.in does not do. Issue certificates, or determine their validity. Both rest with the DGFT.
ebrc.in is operated by Eximfiles, an Indian technology company. It is a private company rather than a government body, and is not affiliated with or endorsed by the DGFT. The DGFT operates no approval, accreditation or empanelment scheme for software of this kind; no provider holds such a designation, and ebrc.in makes no such claim.
Where ebrc.in accesses the DGFT portal, it does so as your authorised agent, on your instruction, under the express and revocable mandate described below. Every filing is your own self-certified submission.
Acting on your instructions
When you sign up you accept our Terms of Service, and when you connect your DGFT account you give express, recorded consent appointing Eximfiles as your authorised agent: we access the DGFT portal on your behalf, retrieve your remittance records, and submit the filings you initiate or approve. Every filing made this way is your own self-certified submission, exactly as if you had made it on the portal yourself. The mandate is revocable at any time: ask us to disconnect your DGFT account and the stored credentials are removed, and we keep an audit trail of consents, instructions, and submissions.
Nothing is binding until you say so
Every workspace has a Test mode and a Live mode. Test submissions go to the DGFT's sandbox, so you can check your format and mapping without creating a real certificate. Switching to Live is an explicit step, and every certificate records the environment it was created in. Every row of a bulk upload is checked before anything reaches the DGFT, and resubmitting never creates a duplicate filing.
Protecting your information
- Your DGFT password: encrypted at rest and never shown back to you. When you update it, we replace the stored password immediately.
- Your data: we handle personal data in line with the Digital Personal Data Protection Act, 2023 and other applicable Indian law. See our Privacy Policy for details.
- Safeguards: we apply administrative and technical safeguards to protect your information, and access to the systems that hold it is restricted to the people who operate them.
- What we never do: we do not sell your data, we do not use your filing data for advertising. We do not use identifiable filing data to train models.
The questions we are asked most
Does ebrc.in process my data on its own systems?
Yes, to the extent your filings require it: the records a certificate is built from, and the certificates issued to you. Personal data is handled under the Digital Personal Data Protection Act, 2023 and our Privacy Policy, which sets out what is collected, why, and how long it is kept. We do not sell your data and we do not use your filing data for advertising. We do not use identifiable filing data to train models; feature and model development is carried out on aggregated or de-identified information, save for internal analysis of your own records where that is necessary to operate and improve the Services for accounts like yours.
Is there a backdoor into my DGFT account?
No. You connect your DGFT account once, at setup, so that ebrc.in can be recognised as acting for you, and from then on the work runs on that connection. ebrc.in acts as your authorised agent under the express, recorded and revocable mandate you grant at that moment, and it acts to carry out the retrievals and filings you ask for. What that mandate permits is set out in full in our Terms of Service, and the complete data and security statement is in your workspace once you sign in.
Can a filing reach the DGFT without me?
No. Nothing is filed unless you file it. Every workspace has a Test mode that goes to the DGFT's sandbox, so you can check your mapping and your amounts without creating a real certificate, and nothing is binding until you switch to Live and confirm. After a Live filing we follow that filing's progress so the certificate reaches you without you watching for it.
Can I withdraw the mandate?
Yes, at any time. Ask us to disconnect your DGFT account and we confirm when it is done; write to amin@eximfiles.io. While your account is open you can export your full filing ledger to Excel whenever you want, so nothing you have built here is trapped.
If your question is not answered here, write to amin@eximfiles.io. We answer questions about data handling from people who are not customers yet, because that is usually when they matter most.
For platform partners
Access to the platform's API is contract-gated: production access follows the signed Master Platform Agreement, covering production access and mutual confidentiality, completed electronically. API keys are shown once at creation and are never stored in a readable form, and every certificate created through the API records whether it was made in the sandbox or in Live. Programmatic use is governed by our API Terms, which bind platforms to the same end-customer mandate and data obligations described above.
Responsible disclosure
If you believe you have found a security vulnerability in the platform, write to amin@eximfiles.io with enough detail for us to reproduce it, and give us a reasonable opportunity to remediate before any public disclosure. Do not access data that is not yours, do not degrade the service for others, and do not test against Live accounts or real filings. We acknowledge reports and act on verified issues promptly.
Questions and grievances
If you have questions about compliance or how we handle your information, reach us through the contact form on this site. Our Grievance Officer under Indian law is Amin Naik (amin@eximfiles.io); see the Terms of Service and Privacy Policy for the full grievance process and your rights under the Digital Personal Data Protection Act, 2023.