Security

Last updated: 3 September 2026

FGSONE holds statutory tax data belonging to banks, public sector undertakings and government departments, where a data incident is a reportable event rather than an inconvenience. This page sets out how that data is protected, who is responsible for each control, and what happens if something goes wrong.

ISO 9001 : 2015

Quality Management System

ISO 27001 : 2022

Information Security

SOC 2 Type II

Operational Trust Center

AES-256 Encryption

Multi Factor Authentication

Data Security

Encryption

Traffic between browsers and the application is carried over TLS, and file transfers use SFTP or FTPS — plain FTP and unencrypted HTTP are not supported. Data at rest is stored on an Oracle-backed database encrypted with AES-256, with key material managed inside your environment so no keys are held by Figment.

Entity Isolation

Each registration and legal entity sits within its own scope, enforced in the data layer rather than only in the interface. A user provisioned for one entity cannot query another, and consolidated group reporting is produced by an explicitly privileged role rather than by relaxing the boundary.

Retention and Disposal

Retention follows the statutory requirement for the record type, which for most Indian tax records extends well beyond the filing year. Disposal at end of contract follows the process in your service schedule, with written confirmation on completion.

Identity and Access Control

Multi-factor Authentication

Multi-factor authentication provides an extra layer of security by demanding an additional verification that the user must possess, in addition to the password. This can greatly reduce the risk of unauthorised access if a user's password is compromised. MFA can be enforced organisation-wide, or required only for privileged roles such as those able to release a return.

Single sign-on and role-based access

Single sign-on against your directory keeps account creation, password policy and revocation under your control. Permissions are granted by role and scoped to entities, so a regional team sees only the registrations it owns while central compliance sees the group. Auditor roles are read-only by construction.

Maker-checker and audit trail

Preparing a return and releasing it are separate rights: one user prepares, another approves, a rejection carries its reason back to the preparer, and delegation during leave is time-limited. Every action is attributed and timestamped, retained for the statutory period, and exportable in the form an audit will ask for it. Sessions time out on inactivity and concurrent session limits can be enforced.

Backup and Continuity

Backups protect against two different failures — losing data, and losing time. A filing deadline does not move because a database needed restoring, so the schedule is designed around recovery speed as much as durability.

Scheduled backups of database and configuration, at the frequency agreed in your service schedule.
Encrypted at rest and in transfer, to the same AES-256 standard as the primary store.
Restoration tested rather than assumed. An untested backup is a hypothesis, not a control.
Recovery objectives — RPO and RTO stated explicitly in your service schedule.

For an on-premise deployment the schedule runs on your infrastructure and is executed by your team; we provide the configuration, the runbook and support for restoration testing.

A continuity plan covers loss of a primary site, with the recovery sequence, owners and communication path documented.