Licensed GSP
GSTN Licensed GSP
Directly empanelled GST Suvidha Provider ( BVM IT Consulting Services India Private Limited) connected straight to GSTN core systems with zero intermediary proxies.
Authority: GSTN
Enterprise Security & Reliability
Enterprise-grade security built for scale.
Security engineered at every layer to meet enterprise standards. Protect data in transit and at rest with TLS 1.2+, AES-256, OAuth 2.0, IP allow-listing, and SHA-256 RSA request signing.
TLS 1.2+ EnforcedOAuth 2.0 Bearer TokensAES-256 At RestIP Allow-Listing7-Year Audit Logs
Licensing & Compliance
Government authorizations & independent audits.
Direct statutory licensing combined with rigorous independent verification to meet enterprise security standards.
Authorized
NIC IRP Authorized
Authorized direct connection to National Informatics Centre (NIC) Invoice Registration Portal for sub-second IRN generation.
Authority: NIC
Authorized
NIC e-Way Bill Gateway
Direct high-throughput pipe for e-Way Bill generation, Part-B multi-vehicle updates, and automated validity extensions.
Authority: NIC
Certified
ISO 27001:2022 Certified
Independently audited Information Security Management System (ISMS) covering cloud architecture, code, and operational controls.
Audited Annually
CERT-In Empanelled Audited
Annual Vulnerability Assessment and Penetration Testing (VAPT) conducted by CERT-In empanelled cybersecurity auditors.
Authority: CERT-In
Compliant
DPDP Act 2023 Compliant
Fully aligned with India's Digital Personal Data Protection Act 2023 — zero unauthorized sharing and strict customer data ownership.
Authority: MeitY / India
Defense in Depth
Architectural security controls across every layer.
Comprehensive coverage across transport, authentication, role-based authorisation, storage encryption, and immutable audit logs.
Transport Security
TLS 1.2 minimum enforced across every endpoint with perfect forward secrecy and strict HSTS preloading.
TLS 1.2 minimum, TLS 1.3 preferred. Insecure HTTP, SSL, TLS 1.0, and TLS 1.1 are completely rejected at the edge.
HTTP Strict Transport Security (HSTS) with 1-year max-age and includeSubDomains enabled.
Certificate Transparency: all SSL/TLS certificates logged to public CT logs; certificate pinning available on Enterprise.
Perfect Forward Secrecy (PFS) enforced via ECDHE key exchange cipher suites.
Authentication & Credentials
OAuth 2.0 client credentials with 1-hour bearer tokens, optional IP allow-listing, and SHA256-RSA signing.
OAuth 2.0 client_credentials grant with strict 1-hour bearer-token expiration.
Tokens issued against independently rotatable client_id + client_secret pairs.
Optional IP allow-listing per client_id — requests from non-allowed IPs immediately receive HTTP 403 Forbidden.
Optional SHA256-RSA request signing on Enterprise: customer signs request body with private key; WhiteBooks verifies against registered public key.
Webhook delivery includes HMAC-SHA256 signature (X-WhiteBooks-Signature header) using a shared secret.
Authorisation & RBAC
Granular role-based access control, multi-GSTIN scoping, and SAML 2.0 / OIDC SSO on Enterprise.
Owner Role: Full management over workspace, billing, and API client credentials.
Admin Role: Full configuration and team management across all compliance modules (excluding billing).
Filer Role: Authorized to prepare and submit GST returns / generate IRNs without modifying account settings.
Read-Only Role: View-only permissions across returns, registers, and audit reports without action capabilities.
Multi-GSTIN scoping: restrict individual team members to specific GSTINs within a multi-entity account.
Enterprise Single Sign-On (SSO) supported via SAML 2.0 and OIDC.
Data Protection & Encryption at Rest
AES-256 encryption across all storage volumes, isolated backups, and synthetic sandbox environments.
All data at rest is encrypted with AES-256 using managed Key Management Services (KMS).
Database snapshots and automated backups are encrypted with restricted IAM access policies.
Privileged access is strictly logged, monitored, and reviewed on a monthly basis.
Production customer data is never copied to non-production environments; Sandboxes use 100% synthetic test data.
Audit Logging (7-Year Retention)
Append-only immutable audit logs matching GST statutory requirements, queryable via REST API.
Every state-changing API call writes to an append-only audit log retained for 7 years per GST Act requirements.
Customers can pull audit logs programmatically via GET /accounts/api/v1/audit-log endpoint.
Each log entry records: timestamp, requestId, client_id, action, target, IP address, user-agent, and result payload.
Tamper-evident log streams can be integrated with enterprise SIEM security dashboards.
Perimeter Defense & IP Allow-Listing
Multi-layer WAF protection, rate-limiting, and optional CIDR IP allow-listing for enterprise API keys.
Enterprise IP / CIDR allow-listing to restrict API traffic strictly to your corporate network addresses.
Multi-layer Web Application Firewall (WAF) inspects ingress payloads and blocks OWASP Top 10 exploits.
Real-time DDoS mitigation and automated rate-limiting protect against traffic bursts and abusive requests.
Isolated Virtual Private Clouds (VPCs) ensure internal services and databases have zero direct public internet exposure.
Technical Specifications
Security Controls & Protocol Matrix
Cryptographic, operational, and audit standards enforced on all WhiteBooks production endpoints.
| Control Parameter | Standard / Specification | Implementation Details |
|---|---|---|
| In-Transit Encryption | TLS 1.2+ / TLS 1.3 | ECDHE key exchange, AEAD cipher suites, strict HSTS preloading. |
| At-Rest Encryption | AES-256 (KMS Backed) | Hardware-backed Key Management Service with automatic key rotation. |
| API Authentication | OAuth 2.0 client_credentials | 1-hour auto-expiring bearer tokens with rotatable client secrets. |
| Enterprise Request Signing | SHA256-RSA (Optional) | Customer private key signing; prevents payload tampering if token is exposed. |
| Webhook Verification | HMAC-SHA256 | X-WhiteBooks-Signature header verified via shared webhook secret. |
| Access Governance | Granular RBAC + SSO | Owner, Admin, Filer, Read-Only roles + SAML 2.0 / OIDC single sign-on. |
| Audit Log Retention | 7 Years (Statutory) | Append-only logs queryable via GET /accounts/api/v1/audit-log. |
| Vulnerability Auditing | Annual CERT-In VAPT | Regular grey-box & black-box penetration tests by CERT-In empanelled auditors. |
Responsible Disclosure Program
Vulnerability Reporting & RFC 9116 Policy
Our responsible disclosure policy is published at /.well-known/security.txt. Please report potential vulnerabilities to security@whitebooks.in. We acknowledge reports within 2 business days and patch high-severity issues within 30 days.
Frequently Asked Questions
Enterprise Security FAQ
In addition to 1-hour token expiry and optional IP allow-listing, Enterprise customers can enable SHA256-RSA request signing. You sign the payload with your private key and WhiteBooks validates it with your registered public key, preventing tampering even if a bearer token is compromised.
Every webhook notification sent by WhiteBooks includes an X-WhiteBooks-Signature header generated using HMAC-SHA256 with your shared webhook secret. You can compute the HMAC on your receiving server to guarantee the payload originated from WhiteBooks.
WhiteBooks provides 4 standard roles: Owner, Admin, Filer, and Read-Only. You can scope user permissions to specific GSTINs, ensuring local branch accountants can only access their allocated entity while corporate admins maintain group-wide visibility.
All state-changing actions and API transactions write to an immutable append-only audit log retained for 7 years to fulfill GST Act compliance. You can inspect logs in the dashboard or export them via GET /accounts/api/v1/audit-log.
We maintain a responsible disclosure program following RFC 9116 guidelines (/.well-known/security.txt). You can email security@whitebooks.in. Our team acknowledges reports within 2 business days and provides regular remediation updates.
Ready to review our enterprise security posture?
Request our Security Architecture Whitepaper, CERT-In VAPT audit summary, or schedule a technical session with our InfoSec team.