Compliance

Ximplex is built for businesses operating under Nigerian tax and financial reporting rules. This page sets out the obligations the software is designed around, the controls we operate, and — just as importantly — the parts that remain yours.

We describe what the product does. We do not certify your compliance. Whether your books, filings and returns are correct depends on the data you enter and the decisions you make, and this page is not a substitute for advice from a qualified accountant or tax adviser.

The software is designed to help you record and organise the information behind common Nigerian tax obligations:

• Value Added Tax — VAT is applied at line-item level with the standard rate as a fallback, and output and input VAT are tracked so a return can be prepared from your records.
• Pay As You Earn — payroll runs calculate PAYE alongside statutory deductions, and retain the records behind each run.
• Withholding Tax — WHT is tracked against the transactions it relates to, so amounts withheld can be reconciled and remitted.
• E-invoicing — invoices are produced in a structured format intended to meet current e-invoicing validation requirements.

Rates, thresholds and filing formats change. We update the software as rules change, but you are responsible for confirming that what you file is correct and for filing on time with the Federal Inland Revenue Service and any state authority that applies to you.

We process personal data in line with the Nigeria Data Protection Act 2023. Our Privacy Policy sets out the lawful bases we rely on, how long we keep data, and the rights you and your people can exercise.

Where you enter records about your own employees, customers or suppliers, you are the data controller for that information and we process it on your instructions. You are responsible for having a lawful basis to collect it and for telling those people how it is used.

If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Nigeria Data Protection Commission and affected customers within the timeframes the Act requires.

Bank connections are provided through [licensed open-banking partner], which holds the licence required to provide account-information services. You authenticate directly with your bank or with that partner — your banking credentials are never entered into Ximplex and are never visible to us.

The connection is read-only. Ximplex retrieves balances and transactions so they can be matched against your records; it cannot move money or initiate payments. You can revoke a connection at any time from your account settings.

The controls we operate include:

• Encryption of data in transit using TLS, and encryption of stored data at rest.
• Authentication with support for a second factor, and session handling that expires idle sessions.
• Role-based access, so the permissions you grant a team member limit what they can see and do.
• Restricted staff access to production systems, granted only where a task requires it.
• Logging of account and administrative activity.
• Regular backups, so records can be restored after a failure.

We hold no third-party security certification at this time. Where we obtain one, it will be named here rather than implied.

Posted transactions are retained with the details of who created or amended them and when, so a change can be traced rather than silently overwritten. Closed fiscal periods are locked against further posting.

Nigerian tax and companies legislation requires accounting records to be retained for a set period. We retain your records for at least that long, including after an account is closed, and you can export them at any time while your account is active.

Compliance is shared. Ours is to run the software securely and keep it aligned with current rules. Yours includes:

• Entering complete and accurate information, and reviewing anything imported from a bank before relying on it.
• Registering with the relevant tax authorities and filing returns by their deadlines.
• Choosing the correct tax treatment for each transaction, and taking advice where the position is unclear.
• Managing who has access to your account and removing users who no longer need it.
• Meeting your own obligations as a data controller towards your employees, customers and suppliers.

To report a security vulnerability, a suspected data breach, or a compliance concern, contact [compliance@domain]. Please include enough detail for us to reproduce or verify the issue. We investigate every report and will confirm receipt.

Please do not test the security of the service against live systems or other customers' data without our prior written consent.