Security

Protecting your personal and business data is a core responsibility we take seriously at FiscEdge. We have implemented technical and organisational measures designed to safeguard your information against unauthorised access, disclosure, alteration, and destruction.

This page provides a transparent, high-level overview of our security practices. It is intended to give you the information you need to understand how your data is protected — without overstating or misrepresenting our security posture.

Security is a continuous effort. We regularly review and improve our practices as the threat landscape and industry standards evolve.

FiscEdge is hosted on industry-standard cloud infrastructure. We rely on established, reputable cloud and infrastructure providers that maintain their own rigorous security certifications and controls.

• Our platform is hosted in data centres with physical access controls, redundancy, and availability guarantees
• We leverage managed cloud services that are designed for reliability, scalability, and security
• Infrastructure is isolated and access is restricted to authorised personnel only
• Regular infrastructure maintenance and patching is performed to address known vulnerabilities

Note: We do not publish specific infrastructure provider names in this public document. This information is available to enterprise clients under NDA on request.

We apply a data minimisation approach — we collect only the data necessary to provide our Services. We have structured our internal data handling to reduce unnecessary exposure of personal information.

• Data is categorised by sensitivity and handled according to its classification
• Access to user data by internal team members is restricted to those with a legitimate operational need
• User data is logically separated to prevent cross-account access
• Data deletion processes are in place to honour user requests and our retention policy

We maintain strict access control policies governing who can access platform systems, data, and infrastructure:

• Access to production systems is restricted to authorised engineering and operations personnel
• Role-based access control (RBAC) is applied to limit access based on operational need
• Access privileges are reviewed regularly and revoked promptly when no longer required
• Administrative access requires additional authentication factors
• All access to sensitive systems is logged for audit purposes

We implement the following measures to protect user accounts:

• Secure session management with automatic expiry after inactivity
• CSRF (Cross-Site Request Forgery) protection on all sensitive operations
• Rate limiting on authentication endpoints to mitigate brute-force attacks
• Email verification required for new account registration
• Secure password reset flows using time-limited, single-use tokens

We maintain logging and monitoring systems to detect anomalous behaviour, security events, and platform errors. Our approach includes:

• Logging of access and key operations across platform systems
• Alerting on patterns that may indicate security threats or abuse
• An internal incident response process for identifying, containing, and remediating security events
• Notification procedures for affected users in the event of a data breach, in accordance with applicable law

In the event of a security incident that affects your data, we will notify you within the timeframes required by applicable law and take appropriate steps to mitigate harm.

We rely on third-party service providers to deliver parts of our platform infrastructure, including hosting, database management, email delivery, AI processing, and analytics. These subprocessors are selected for their security standards and are contractually obligated to protect data processed on our behalf.

We maintain a list of key subprocessors. Enterprise clients may request details of our subprocessor relationships under a data processing agreement.

We welcome responsible disclosure of security vulnerabilities. If you believe you have discovered a security issue in the FiscEdge platform, please report it to us as soon as possible.

• Email: security@fiscedge.com
• Please provide a clear description of the issue, steps to reproduce, and potential impact
• Do not attempt to access other users' accounts or data as part of your research
• Do not disclose the vulnerability publicly before we have had a reasonable opportunity to investigate and remediate

We will acknowledge valid reports and work with you in good faith to understand and address the issue. We do not currently operate a formal bug bounty programme, but we value responsible disclosure and will recognise significant contributions at our discretion.

Security is a shared responsibility. While FiscEdge works to protect platform infrastructure and our systems, users also play a critical role:

This page is updated periodically to reflect changes in our security practices, tooling, or policies. The "Last Updated" date at the top indicates when this page was last revised.

We do not guarantee that all information herein is current at any given moment, but we commit to reviewing and updating this page at least annually or following material changes to our security posture.

For security-related matters, please reach us at:

• Security vulnerabilities: security@fiscedge.com
• General security questions: info@fiscedge.com
• Data protection inquiries: privacy@fiscedge.com
• Address: [Registered Address]