Corporate Governance
How we are governed, and how we hold ourselves to it
Aspera Technologies handles GST registrations, statutory filings and KYC records for thousands of businesses. That work only holds if our own controls are stronger than the ones we advise on. This page sets out our governance structure, our policy framework, and the standards we can be held to.
- Legal entity
- Aspera Technologies Private Limited
- CIN
- U72900PN2022PTC211370
- Registered office
- Pune, Maharashtra, India
- Governance owner
- Board of Directors
Governing principles
Five commitments that decide how we act when the commercially convenient answer and the correct one diverge.
-
i
We do not sell a registration we could not defend at a physical verification
Every address we offer is a premises we own or hold under a registered lease, with signage, staff presence and records available to the officer on inspection. We decline business we cannot support on the ground.
-
ii
Client data is held in trust, not as an asset
KYC documents, GST credentials and financial records are collected for a stated purpose, retained only as long as that purpose and the law require, and never sold, brokered or used to build products the client did not consent to.
-
iii
We deal with authorities on the record
Correspondence with tax departments is written, filed and traceable. We do not make payments, offer inducements or seek outcomes through informal channels, and we terminate relationships with any partner who does.
-
iv
Claims we publish are claims we can evidence
Client counts, premises counts, turnaround times and accreditations stated in our marketing are traceable to internal records and reviewed before publication.
-
v
Concerns reach the Board without passing through the person concerned
Anyone — employee, client, vendor or partner — can raise a governance concern through a channel that does not route via line management, and receive a response.
We are a compliance business. Our own compliance record is the product demonstration.
Board of Directors, Aspera Technologies Private Limited
Governance structure
Aspera Technologies is a private limited company. Authority flows from the Board through defined delegations; each tier below records what it decides and what it must escalate.
| Entity | Jurisdiction | Role in the group |
|---|---|---|
| Aspera Technologies Private Limited | India | Parent company. Operates TheGSTCo — VPOB, virtual office and GST compliance services. |
| SimplySetup Private Limited | India | Virtual office and company incorporation services for non-ecommerce clients. Formerly GMCS Ecommerce Private Limited. |
| Aspera Pte Ltd | Singapore | International entity. UEN 202446756E. Cross-border structuring and international client servicing. |
Control framework
Six control areas, each with a named owner, a defined review cycle and evidence retained for inspection.
Statutory compliance
ROC filings, GST returns, TDS, income tax and labour law obligations tracked on a single compliance calendar with owner, due date and filed evidence. Missed or late filings are reported to the Board as exceptions.
Client acceptance
KYC verification before onboarding, screening against sanctioned and disqualified-entity lists where applicable, and documented grounds for declining or exiting a client relationship.
Financial controls
Segregation of duties between billing, collection and reconciliation. Maker-checker on payments above defined thresholds. Books maintained in an accounting system of record with audit trail enabled.
Premises and verification readiness
Every registered address is supported by ownership or registered lease documents, NOC, utility evidence and signage. Records are kept inspection-ready and refreshed on a fixed cycle.
Information security
Role-based access to client records, periodic access reviews, encrypted storage of KYC and credential data, and revocation on exit as part of the offboarding checklist.
Vendor and partner conduct
Written agreements with confidentiality, data protection and anti-bribery terms. Partners handling client data or representing us to authorities are bound to the same standards as employees.
Policy register
Policies adopted by the Board, with the function accountable for each and the cycle on which it is reviewed. Copies are available to clients, partners and auditors on request.
| Policy | Accountable | Review cycle | Status |
|---|---|---|---|
| Code of Conduct | Board | Annual | In force |
| Anti-Bribery & Anti-Corruption | Board | Annual | In force |
| Data Protection & Privacy | Compliance | Annual | In force |
| Information Security & Access Control | Technology | Half-yearly | In force |
| Whistleblower & Grievance Redressal | Board | Annual | In force |
| Prevention of Sexual Harassment (POSH) | Human Resources | Annual | In force |
| Client Acceptance & KYC | Operations | Annual | In force |
| Document Retention & Disposal | Compliance | Annual | Scheduled |
| Delegation of Authority | Board | Annual | Scheduled |
| Related Party Transactions | Board | Annual | Scheduled |
Risk management
We name our principal risks rather than describing risk management in the abstract. Each is reviewed by the Board with the mitigation in place at the time of review.
| Principal risk | What it means for clients | Mitigation |
|---|---|---|
| Regulatory change | Amendments to GST law or departmental practice could alter how additional places of business are registered or verified. | Monitoring of circulars, instructions and judicial precedent; advisers retained in each key jurisdiction; client communication on any change affecting registrations. |
| Enforcement action at a premises | Departmental scrutiny of a shared address can affect multiple registrations at once. | Owned premises with complete documentation, staffed presence and signage; defined response protocol; representation before the department and coordination with affected clients. |
| Data breach or misuse | KYC documents and GST credentials are sensitive and, if exposed, cannot be un-exposed. | Role-based access, encryption, periodic access reviews, vendor data terms, and an incident response and notification process. |
| Marketplace and partner dependency | Accreditations and referral relationships with platforms are material to demand. | Diversification across platforms and direct channels; adherence to each platform's partner standards; relationship ownership at leadership level. |
| Service quality and turnaround | A missed filing or delayed registration has direct financial consequences for the client. | Filing calendar with named owners, escalation on ageing items, and exception reporting to leadership rather than client-initiated follow-up. |
| Key person concentration | Institutional knowledge concentrated in individuals creates continuity risk. | Documented processes, systems of record rather than personal files, defined role library and succession planning for critical functions. |
Data protection and security
What we collect, why we hold it, and the limits we place on ourselves.
Purpose limitation
We collect identity, address, business and tax records for the specific purpose of delivering the engaged service and meeting our own statutory obligations. We do not repurpose client data for unrelated products or share it with third parties for marketing.
Access and credentials
Access to client portals and credentials is restricted to staff assigned to that account, logged, reviewed periodically, and revoked on role change or exit.
Retention
Records are retained for the period required by the applicable statute and our retention policy, then disposed of securely. Clients may request confirmation of what is held for them.
Incident response
Suspected incidents are escalated immediately, contained, investigated, and notified to affected clients and authorities where the law requires. We do not treat silence as a containment strategy.
Sub-processors
Third parties that process client data on our behalf are contracted with confidentiality and data protection terms and are reviewed before engagement.
Cross-border handling
Where an engagement involves our Singapore entity, data transfer and processing are governed by intercompany agreements and applicable data protection and exchange-control requirements.
Code of conduct
Binding on directors, employees, contractors and channel partners acting in our name.
-
01
No facilitation payments, in any form
No cash, gift, hospitality or benefit is offered to any public official or their intermediary to obtain, expedite or influence a decision. There is no threshold below which this becomes acceptable.
-
02
Declare conflicts before they become decisions
Personal, financial or family interests that could influence a business decision are disclosed to the Board in advance, and the person concerned steps out of the decision.
-
03
Represent our services accurately
No guarantee of a regulatory outcome, no misstatement of processing times, no claim of an approval or accreditation we do not hold.
-
04
Keep client information confidential
Client data is discussed only with those who need it to deliver the service, and never shared with a client's competitors, counterparties or any third party without instruction.
-
05
Treat people fairly
Hiring, pay, progression and daily conduct are free from discrimination and harassment. Our POSH framework applies to all workplaces including remote and client-site work.
-
06
Report what you see
Failing to report a known breach is itself a breach. Good-faith reporting is protected regardless of whether the concern is ultimately substantiated.
Speak up
A concern about fraud, bribery, data misuse, harassment or misrepresentation can be raised by anyone, without going through line management.
Raise it
Write to the governance mailbox below with what happened, when, and who was involved. You may identify yourself or not — anonymous reports are accepted and investigated on the same basis.
Acknowledgement
Identified reports are acknowledged within five working days. The report is routed to the Board, and anyone named in it is excluded from handling it.
Investigation
Facts are gathered, records reviewed and relevant people interviewed. Where the matter is material or involves leadership, independent advisers are engaged.
Outcome and protection
Findings and any corrective action are recorded. Retaliation against a good-faith reporter is a disciplinary matter in its own right, treated as seriously as the original concern.
Governance contacts
Policy copies, compliance queries and reports of concern are handled through the channels below.
Compliance and legal
Statutory queries, policy copies, due diligence requests and regulatory correspondence.
Report a concern
Fraud, bribery, data misuse, harassment or misrepresentation. Anonymous reports accepted.
Data protection
Requests concerning personal data held about you, retention periods and deletion.
Registered office
Aspera Technologies Private Limited
Office No. 305, ICON IT Park, Narhe, Pune 411041, Maharashtra, India