One register of who holds each GST, tax and seller-portal login in a small firm
TL;DR Keyroster is a shared-login manager built around the government and marketplace portals that small Indian firms live on. It tracks who can use each login, whose phone gets the OTP, and what has to change when an accountant or staffer walks out. CA practices resell it and the firm pays a flat monthly fee.
Ask a small trading or manufacturing firm how many portal logins it runs and you'll usually hear a dozen - GST, income tax, EPFO, ESIC, e-way bill, a bank's corporate login and two or three seller panels. The owner, an accounts clerk and an outside CA all use them, often out of a notebook or a chat-app group. When the clerk leaves, nobody resets a thing.
There are about 5.45 lakh small and 42,017 medium enterprises on Udyam alone[1]. CERT-In's 2025 baseline for MSMEs asks for password hygiene training and access control[2], and most of these firms have neither. I couldn't find a survey that measures how often shared portal logins get misused, so that's the first thing to test.
Keyroster is a vault, but it's organised around the portal and not the password. For each login it records the owner of record, the people allowed to use it, the phone number that gets the OTP and the date it was last changed. Staff and the CA open logins through Keyroster, and every use is logged.
When someone leaves, Keyroster hands you an exit checklist - which passwords to change, which OTP numbers to move and which portal user accounts to switch off. A monthly report tells the owner which logins haven't changed in a year or still send OTPs to someone who left.
The seed pitched a decentralised, zero-knowledge password manager. Encryption on the user's device is already standard in this category, and decentralisation solves nothing a small firm is asking for. So the reframe keeps zero-knowledge storage and sells the handover routine instead.
Regulatory note: no licence is needed. The DPDP Act and CERT-In directions apply to the data Keyroster stores.
The owner pays, usually because the CA told them to. Business vaults are already cheap - one open-source password manager's team plan costs $4 (about ₹390) per user a month[3] and an Indian vault's business tier is also $4[4]. Keyroster would price per firm and not per user (our estimate is ₹500–1,500 a month), because a 10-person firm with three login holders is not going to pay for ten seats. CA practices earn a referral share.
CERT-In published 15 baseline controls for MSMEs on 1 September 2025 and suggested a yearly audit by an empanelled auditor[2]. Large buyers have started asking small suppliers about it. The DPDP Rules notified in November 2025 carry penalties of up to ₹250 Cr for failed security safeguards[5], which raises the stakes for anyone holding customer data.
There's no public figure for what Indian small firms spend on shared-login tools. The reachable base is about 5.87 lakh small and medium firms on Udyam[1], plus the micro firms that file GST through a CA. On the adjacent side, one password manager's $100M round in 2022[6] shows investors do back the general category.
An Indian password vault offers sharing, audit trails and emergency access[4]. Global password managers serve teams worldwide[3]. All of them are general tools, so they'll store any password and leave the firm to figure out which ones matter.
None of them is built around Indian portals, OTP routing or staff exits. The gap is narrow and a big vendor could copy it, but the CA channel is hard for them to reach.
| Difficulty | Moderate (31/100) |
| Starting capital | ₹45–80 L |
| Time to launch | 6–9 months |
Building a secure vault is well-trodden ground, though you do have to do it carefully. Distribution is the hard bit, which means getting CA practices to put Keyroster in front of clients and then getting owners to move logins out of their notebooks. Expect every new firm to need a hand-held first session.
No licence is needed to sell a login manager. What applies is the baseline plus the security rules on the data you hold.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI see or store the actual passwords. Keep it on the metadata, because the vault's whole promise is that nobody but the firm can read them.
Want to work out the AI layer for Keyroster? Talk to Yash →
I'd back this for a founder who already sells software through CA practices or tax-filing networks. If you're hoping to win on encryption tech then it's a weak bet, honestly. Before anything else, prove that 10 CAs will each bring in five paying clients within three months.
The free Keyroster validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for firm owners and CAs, and 5 assumptions to test. Download the kit →
Thinking about building Keyroster or something close to it? The make-or-break work is turning CA practices into a sales channel that brings in clients every month, and that's the kind of thing I like working through with founders. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.