Security at VitalReturns

Last updated: 12 October 2026

VitalReturns is a tax compliance platform operating on behalf of businesses, accountants and tax agencies across Uganda. Because the data we process is regulatory, financial and personally identifiable, our security program is designed around three principles: least privilege, defence in depth and full auditability.

Encryption

In transit: All connections to the platform use TLS 1.3 with modern cipher suites. HSTS is enforced on the public domain with a one-year max-age.

At rest: Databases, backups and uploaded workbooks are encrypted using AES-256 at the storage layer. Credentials for upstream integrations (URA, banks, mobile money) are stored in an isolated secret vault with per-tenant access scoping.

Access controls

Authentication: Multi-factor authentication (TOTP) is available to every account and required for platform administrators. Password storage uses bcrypt with cost factor 12.

Authorisation: Every mutation goes through a role-based access check tied to the authenticated session. Platform-admin, workspace-admin, member and viewer roles map to distinct capability sets. Session timeouts are enforced on both the server and the client.

Audit trail

Every write operation — settings change, obligation prepared, return filed, payment issued, permission granted — is recorded in an append-only audit log indexed by actor, workspace, taxpayer and time. The audit log is retained for the life of the account and is exportable on request.

Platform integrity

Separation of environments: Production, staging and development are deployed in isolated environments with distinct credentials. Developer access to production is time-boxed and logged.

Change control: Every deployment originates from a merged pull request on the main branch, runs the full test and type-check suite, and is traceable to a specific release artifact.

Vulnerability disclosure

Report suspected vulnerabilities to security@vitalreturns.ug. We acknowledge all reports within three business days. Please do not disclose details publicly until we have confirmed a fix.

Compliance posture

VitalReturns processes taxpayer data in accordance with the Uganda Data Protection and Privacy Act 2019 (DPPA) and the Uganda Revenue Authority record-keeping requirements. See the Privacy Policy for details on data subject rights.