SDD Software; Structured Digital Database for SEBI PIT Compliance

Affinisio(SDD) — Structured Digital Database — is a key module of the Affinisio suite by Affinisio Technologies LLP. It maintains the structured digital database mandated by Regulation 3(5) of the SEBI (Prohibition of Insider Trading) Regulations, 2015 in India, capturing every instance of unpublished price-sensitive information (UPSI) sharing — internal and external — with the nature of the UPSI, the persons sharing and receiving it, their identifiers, and precise time-stamps, in a strictly non-tamperable, internally maintained and automated database with a complete audit trail. Affinisio(SDD) is fully certified for regulatory compliance and is used by a large number of listed entities, conglomerates, financial institutions, intermediaries and fiduciaries, with specific variants that serve the automation needs of each.

Under Regulation 3(5) of the SEBI (Prohibition of Insider Trading) Regulations, 2015, every entity that handles unpublished price-sensitive information (UPSI) must maintain a structured digital database. This includes listed companies — equity-listed, debt-listed, and companies proposed to be listed — SEBI-registered intermediaries such as merchant bankers, asset management companies, investment advisory firms, credit rating agencies, mutual funds and fiduciaries such as auditors, law firms and transaction advisors. Each entity must maintain its own SDD internally, and it cannot be consolidated across a group. Affinisio(SDD) serves all of these segments, with dedicated variants for listed entities, intermediaries or fiduciaries and mutual funds.

For every instance of UPSI sharing, an SDD must record the nature of the UPSI, the identity of the person sharing it, the identity of every recipient, the PAN or other legally authorised identifier of each such person and their organisation, and the date and time of both the sharing and the entry. Affinisio(SDD) captures all of this in a single, guided workflow — logging each event as sender, receiver or central point of contact, auto-filing entries to every individual’s account, and applying compliance-controlled or custom UPSI descriptions — with automatic time-stamping and a non-tamperable audit trail on every record, up to and including fully internal and secure email auto-population.

SEBI requires that once an SDD entry is made it cannot be edited or deleted — corrections must be logged as a new entry referencing the original — and that every entry carry a time-stamp and audit trail identifying who made it. Affinisio(SDD) enforces this by design: entries are immutable, every correction is captured as a record that can be referenced, and each action is time-stamped with the user’s identity in a continuous, non-tamperable audit trail. Because the database is maintained internally and never outsourced, the entity retains complete control, and the full trail is available on demand for board review, secretarial audit and SEBI inspection.

Yes. Affinisio(SDD) is available for on-premises deployment as well as privately controlled cloud under the user’s administration, so the structured digital database is maintained internally on infrastructure the entity controls. As SEBI requires, the software may be provided by a vendor, but the database itself is never outsourced — and Affinisio never has access to the UPSI. This keeps the confidentiality, integrity and control of the SDD entirely with the board and compliance officer, satisfying the internal-maintenance requirement while giving organisations with strict data-residency policies full ownership of their compliance data.

It depends entirely on who administers that infrastructure. SEBI’s Comprehensive FAQs of 31 December 2024 do not prohibit cloud; they place the test on control and accountability, stating that the Board “is solely accountable for all aspects related to the maintenance of data on cloud or any other method” and must ensure the confidentiality, integrity and security of its data and logs. A private cloud tenancy that the entity owns, administers and secures itself is consistent with Regulation 3(5). Software supplied on a login basis, where the vendor maintains the server, is not — because the vendor may have access to the records. Affinisio(SDD) is deployed on-premises or within the entity’s own private cloud tenancy, never on Affinisio-maintained infrastructure.

Yes. Listed entities and other regulated persons must periodically certify their SDD compliance — many through an annual certificate issued by a Practising Company Secretary, and through the compliance certifications sought by the stock exchanges. Affinisio(SDD) is built for this: it generates audit-ready regulatory reports and extracts in the required digital formats on demand, and produces the complete, time-stamped audit trail for any period — giving the compliance officer everything needed for board review, secretarial audit, exchange certification and SEBI inspection, and turning periodic certification and regulatory requests into a ready exercise rather than a manual reconstruction. Affinisio(SDD) is also itself certified for regulatory compliance.