Security & data pack

At a glance

Hosting

DigitalOcean, Singapore (SGP1). Data is stored outside Pakistan.

Backups

Singapore (SGP1), with a second copy of the nightly backup in Frankfurt (FRA1).

In transit

HTTPS only, with HSTS for one year.

Backup encryption

Continuous database backups are encrypted with libsodium before they leave the server.

Between customers

Postgres row-level security, forced on every table that holds a workspace's vendor and evidence data.

Evidence

Append-only. No application account can edit or delete it, and database triggers refuse edits from every account.

Sign-in

A single-use link sent to your email. No passwords.

Staff access

Staff accounts only, and only from allow-listed IP addresses.

Deletion

On request, within 30 days. Full export at any time.

FBR

CheckOne reads FBR's public files. It never sends your data to FBR.

01Who provides CheckOne

Service

CheckOne, a subscription service of FormOne

Legal entity

Arure Technologies (SMC-Pvt.) Limited

NTN

5286498

Based in

Lahore, Pakistan

App

checkone.formone.pk

Free checker and this pack

formone.pk/checkone

Contact

support@formone.pk

CheckOne runs separately from FormOne's company-registration service: its own database, cache, file storage, sign-in and billing. The only connection between the two is a signed message FormOne sends when a company is incorporated through FormOne, so that the new company can be invited to CheckOne.

CheckOne is preparing for launch. The email provider, the WhatsApp provider and a card and wallet payment gateway are still being chosen; until a gateway is live, invoices are paid by bank transfer.

02What data CheckOne holds

CheckOne does not hold: bank or card details, bank logins, FBR IRIS credentials, passwords, payment amounts or vendor spend, or your vendors' invoices.

The free checker at formone.pk/checkone keeps a keyed hash of the identifier and of the IP address, and the result it showed (an NTN in full with the name FBR publishes for it, a CNIC masked), so the share link works for 7 days. These records are kept permanently and are not linked to any workspace. The checker also sets a signed cookie in your browser, holding a random device ID for one year, to count the day's free checks.

03Where it is stored

DigitalOcean has no region in Pakistan. CheckOne's data is stored in Singapore, with the second backup copy in Frankfurt. Every bucket is private, and each has its own access key: the key the application uses cannot read or delete the backups, and the staging environment has no key to the production buckets.

04Encryption

In transit

• checkone.formone.pk is served only over HTTPS; plain HTTP is redirected. HSTS is set for one year, including subdomains. Certificates are issued and renewed automatically.
• The app's Content-Security-Policy allows scripts, fonts and connections from its own address only, and the app cannot be framed by another site.
• Email is handed to the provider with TLS required. Object storage, the WhatsApp API and FBR's file server are reached over HTTPS, with certificates verified.
• Inside the server, the database, cache and application talk over private container networks. The database is never exposed to the internet, and every network connection to it needs a password (SCRAM-SHA-256).

At rest

• Continuous database backups and weekly base backups are encrypted with libsodium on the server before upload. The key is held in CheckOne's password manager and sealed offline.
• The nightly backup is not encrypted by CheckOne. It is stored in the two private backup buckets, which only the backup service's keys can reach.
• CheckOne does not add its own encryption to the server's disk or to stored files; those rely on DigitalOcean's storage controls.
• Session tokens and sign-in links are stored only as keyed hashes, so a copy of the database does not contain a usable token.
• Secrets are kept in a password manager, never in the code repository, and are placed on the server in memory-backed storage readable only by its administrator account.

05Separation between customers

• Every table that holds a workspace's vendors, uploads, checks, messages, exports, invoices, memberships or audit log has Postgres row-level security enabled and forced. A request sees only the rows of the workspaces its session is allowed to see; with no workspace set, it sees nothing. The setting lasts one database transaction.
• Exceptions: the sign-in tables (user accounts, sign-in links and invitations, sessions), which are read before a workspace is known, and a few routing and log tables, including the stored FormOne incorporation message. These have no row-level security; database grants limit which accounts can reach them.
• The build fails if a table with a workspace column lacks forced row-level security, apart from that reviewed list, or if any application database account can bypass it.
• The web API, the background worker, the staff console, maintenance and backups each use their own database account with only the rights they need. None of the application's accounts is a database superuser.
• A practitioner firm's owner sees the firm's own client workspaces, and no others.

06Append-only evidence

• FBR files, check results, status changes, vendor history, messages sent, the audit log, withholding rate tables and free-checker records are insert-only.
• Three layers enforce it: no application database account may update, delete or truncate those tables; database triggers refuse updates and truncation for every account, the owner included, and refuse deletions outside the workspace removal in section 10; and each loaded FBR file's rows are sealed. Only the database's owner and administrator accounts, used for migrations and maintenance, could get past the triggers.
• A wrong result is never edited. A correction is a new record and a new message, and the original stays in the log.
• Each check stores the SHA-256 of the FBR files it used. Any check can be recomputed from those files and must match the stored result exactly.
• The only way to remove these records is the workspace deletion described in section 10, which needs two approvers.

07Your users' access

• Sign-in is by a link sent to your email, valid for 15 minutes and usable once. There are no passwords.
• The session cookie holds a 256-bit random token and is HttpOnly, Secure and SameSite=Lax. It lasts 30 days, or until you sign out. Removing a user ends their sessions; deleting the workspace ends the sessions open in it (see section 10 for what members can still see until the data is removed).
• Every request that changes something must carry a CSRF token.
• Roles: owner (users, plan and billing, deletion), member (vendors and uploads) and viewer. Invitations are sent by email and last 7 days.
• Sign-in links are rate-limited per email address and per IP address.
• Each Monday message links to that week's results. The link works for 7 days without signing in, so treat it like the message itself.
• CheckOne v1 has no single sign-on (SSO).

08CheckOne staff access

• Staff status is granted only from the command line on the server, never through the website. The staff console answers only to a staff account connecting from an allow-listed office or VPN IP address; with no address listed, it is closed.
• Staff can read across workspaces to support customers. Changes made in the staff console are written to the audit log.
• Two people are needed to approve a withholding rate table, to remove a deleted workspace's data, and to release a held FBR file with an unusual row count.
• The server accepts SSH keys only: no passwords and no root login. Its firewall admits SSH, HTTP and HTTPS only, and the web proxy is the only container that listens on the internet.
• Releases are deployed by script after a server snapshot, never on Sunday after 12:00 or Monday before 12:00 Pakistan time. Every Monday message can be paused at once.

09Backups and recovery

• Continuous: the database's write-ahead log is archived at least every 5 minutes, with a full base backup every Tuesday; the four most recent are kept. The database can be restored to any point in that period, losing at most about 5 minutes.
• Nightly: a logical backup of all customer data at 02:00 Pakistan time (FBR snapshot rows are excluded; they are rebuilt from the stored FBR files), checked to be readable, its SHA-256 recorded, copied to Singapore and Frankfurt and kept 35 days.
• Checked: archiving is checked every 10 minutes and the backups daily. Every week an automated restore runs on a temporary server in Singapore, which is destroyed afterwards. Once a month a timed point-in-time restore drill is run by hand.
• A snapshot of the server is taken before each release.

10Retention, export and deletion

Export at any time

Any user can download a full data export of the workspace (ZIP), the vendor list (Excel or CSV) and evidence exports. Each prints its own content hash and the SHA-256 of every FBR file it relies on.

Deletion

An owner deletes the workspace in Settings. Monday messages, uploads and exports stop at once, and the sessions open in the workspace end. Until the data is removed, its members can still sign in and view the workspace, including each week's results and their PDF, and links in earlier Monday messages keep working for their 7 days. Within 30 days, two CheckOne staff approve the removal of the workspace's vendors, uploads, checks, messages, exports, invoice records, users' memberships and audit rows; its name and branding are blanked and its files are deleted from storage. A log keeps only the counts removed.

Kept after deletion: issued invoice PDFs, as tax records; the workspace's own NTN; user accounts (email, name, WhatsApp number), which can belong to other workspaces, with their sign-in links, invitations, verification-code records and sessions; the FormOne incorporation message, if the workspace came from FormOne (the company's NTN and the contact's name and email); the payment gateway's own payment messages; FBR's published files; free-checker records. Removed data leaves the backups as they rotate: nightly backups after 35 days, continuous backups when their weekly base backup is retired, and the server snapshot at the next release.

11What CheckOne never does

• Never sends your data to FBR. CheckOne's only requests to FBR download FBR's public Active Taxpayer List files and read its public download pages, with an honest user agent. They carry no customer data.
• Never logs in to IRIS or any FBR portal, and never asks for your IRIS credentials.
• Never scrapes captcha-protected FBR pages.
• Never decides a match by name. Matching is by NTN or CNIC; names only suggest.
• Never puts vendor names or identifiers in email or WhatsApp. Messages carry counts, FBR file dates, the rate-table version and a link.
• Never loads third-party scripts, fonts or trackers in the app.
• Never writes a full CNIC to logs. The application masks anything CNIC-shaped in its logs; the database logs slow queries without their values and errors without the row they concern; web access logs drop query strings and shorten IP addresses.
• Never shares your data with anyone beyond the providers listed in section 12.

FBR's file server answers Pakistani IP addresses only, so CheckOne may download FBR's public files through a relay with a Pakistani address. The connection to FBR stays encrypted end to end: the relay sees only FBR's host name and the amount of data, and carries no customer data.

12Subprocessors and other services

A card and wallet payment gateway will be added here when one is chosen. You would enter card or wallet details on the gateway's own page, never on CheckOne.

Services that hold no customer data: GitHub (source code, release workflow and container images) and 1Password (secrets).

The formone.pk website loads FormOne's site-wide services (Google Tag Manager, Google reCAPTCHA, Sentry error reporting, Google Fonts), covered by the FormOne privacy policy. They also run on the free checker's pages. Sentry records errors, page timings and a small sample of sessions there; the site removes the NTN or CNIC and share-link codes from the web addresses it sends to Sentry, and session recordings mask what is typed and shown. A check link puts the NTN or CNIC after a # (formone.pk/checkone#id=…), the part of a web address browsers do not send to servers; a link in the older ?id= form is rewritten to it as the page opens. None of these services runs in the CheckOne app.

13Incidents and contact

• Failures of FBR downloads, checks, message sends and backups alert CheckOne's on-call channel, as do the server's memory, disk and CPU.
• If an incident affects your data, we tell the affected workspaces within 72 hours: what happened, when, and what to do.
• Report a security issue to support@formone.pk with "Security" in the subject.

14For banks and regulated companies: SBP outsourcing framework

For banks and other institutions under the State Bank of Pakistan's framework for outsourcing arrangements (BPRD Circular No. 06 of 2019). Whether CheckOne is a material outsourcing, and any approval or notice that follows, is the institution's assessment.

15Limits of this pack

• CheckOne reports FBR's published status and keeps a dated record. It is not tax advice: rates come from CheckOne's versioned rate table for each section, approved by two people (until one is approved, messages say so instead of showing rates), and your advisor decides how they apply. CheckOne is not affiliated with the Federal Board of Revenue.
• This pack does not claim any third-party certification or external penetration test.
• It describes the service as built on 19 October 2026. If your review needs something it does not cover, send your questionnaire to support@formone.pk.