Secure sharing of tax reports
Share a tax report with a CA, lender or advisor through an expiring, access-controlled link instead of an email attachment — masked by default, with a confirmation of what is shared, an access log and a Revoke button.
Overview
A tax report leaves Property360 only when you decide it does. Instead of attaching a PDF to an email, you create a secure link to a report: the recipient opens a plain page that shows what is shared — the taxpayers (PAN masked), the period, the formats — and downloads the PDF or Excel. The link expires (1 to 30 days, 7 by default), can be limited to a number of downloads, can be revoked at any time, and every open and download is written to an access log you can read. Nothing is sent to anyone automatically: creating a link copies it to your clipboard, and emailing it through Property360 happens only when you click Send by email yourself.
Rules that always apply:
- Masked by default. The taxpayer's PAN reads ABCDE••••F, tenant and deductor PANs are masked, and bank account numbers are never in a report. A shared link is always masked.
- Confirmation before sharing. The dialog lists the taxpayers, the period, the sections and the recipient before the link exists. When the report covers more than one taxpayer or household, it shows an additional warning.
- Authorisation. You can only share profiles you may see, and the report a link serves is generated afresh from the snapshot of what you shared — the recipient can never widen it to other taxpayers, years or sections.
- Audited. Creating a link (INCOME_TAX_REPORT_SHARED), revoking it (INCOME_TAX_REPORT_SHARE_REVOKED), emailing it (INCOME_TAX_REPORT_SHARE_EMAILED) and every public open or download (INCOME_TAX_REPORT_SHARE_ACCESSED, with IP, device and outcome) are in History & Audit.
- No enumeration. The link carries a long random token that is stored only as a hash and shown once; the public page is rate-limited to 20 requests a minute per address, and an unknown, expired, revoked or exhausted link answers with a plain message, never with a hint of what exists.
Before you start
- You need to be a landlord, a master admin or a CA named on the landlord, and the report must be one you can generate yourself (see Income & Tax Reports).
- Decide what the recipient needs: the fewer taxpayers, years and sections, the better. Sharing several taxpayers at once is a deliberate act — see Consolidated household reports.
- Keep the recipient's name (and email, if you plan to send it from Property360) to hand; the label is shown in the Shared links list and in the audit trail.
Steps
Share a report
- Open Operations → Income Tax → Income & Tax Reports (or any Income Tax page) and choose Share… in the Export ▾ menu — or Share… on the Shared links tab.
- Check What the recipient will get: the report, the taxpayers with their masked PANs, the Period, the Sections, the Formats (PDF, Excel or both) and the masking (on, and kept on). When more than one taxpayer or household is included, read the warning and tick it.
- Under Who is this for? enter the recipient's name (for example N. Rao, CA) and optionally a Recipient email.
- Set Link valid for (1–30 days; 7 by default) and, if you want, a Download limit.
- Click Create secure link. The link is shown once — click Copy and paste it into your own email or chat. Send by email sends it to the recipient email you entered, with the expiry, only when you click it; that is the only way Property360 ever sends it. Click Done.
What the recipient sees
The link opens a plain Secure shared report page outside the app — no sign-in, no menu — that names the report, the taxpayers (PAN masked), the period and sections, when the link expires, the note PAN and account numbers are masked, and the download buttons for the formats you allowed. Each download regenerates the report from the shared snapshot and counts against the limit. An expired, revoked or exhausted link shows This link has expired, This link was withdrawn by the person who shared it or This link has reached its download limit, and asks them to request a new one from you.
Review and revoke
- Open Income & Tax Reports → Shared links. Each link shows the Report, the Recipient, when it Expires, its Downloads (and the limit), the Last access and its Status — Active, Expired, Revoked or Limit reached. Refresh reloads the list.
- Open a link's Access log to see every open and download with the time, outcome and the device and network address it came from.
- Click Revoke to withdraw a link immediately. It cannot be re-enabled — create a new one with Share… if needed.
Example
Meera Iyer's bank asks for her last three years' tax position. She generates a multi-year annual report (FY 2023-24 to FY 2025-26, all sections, masked), chooses Share…, enters Home loans desk — R. Mehta as the recipient, sets the link to be valid for 5 days with a limit of 3 downloads, and creates the link. She pastes it into her reply to the bank. Two days later the access log shows one page view and one PDF download from the bank's network. When the loan is sanctioned she clicks Revoke; the bank's copy of the link now says it was withdrawn. The creation, the download and the revocation are all in History & Audit.
FAQs
Can the recipient see the full PAN?
No. A shared link is always masked, whatever the preview showed you. Unmasked reports exist only for your own download.
Can the recipient change the years or add a taxpayer?
No. The link serves exactly the taxpayers, period, sections and metrics you confirmed; nothing in the link can widen it.
Does Property360 email the report automatically?
Never. A link is only created and copied; sending it by email happens only when you click Send by email, and that is audited.
What if I share the wrong report?
Revoke it under Shared links. Any later open answers withdrawn; the access log tells you whether it was downloaded before you revoked it.
Can a CA share a landlord's report?
Yes, for the landlords who name them — within the same scope as generating the report. The landlord sees the CA's links in History & Audit; a master admin sees them under Shared links.
Troubleshooting
"You do not have access to one of the taxpayer profiles"
The report includes a profile outside your scope. Remove it, or ask the landlord who manages it to authorise you. The refused request is audited.
The recipient says the link does not work
Check its status under Shared links: it may have expired, been revoked or reached its download limit — each shows as such. If the status is Active, the recipient may have pasted the link incompletely; the token is long. Create a new link if in doubt.
The access log shows an open I don't recognise
Anyone holding the link can open it until it expires or is revoked. Revoke it and create a new one for the intended recipient; the log keeps the earlier access for the audit trail.