Can a listed company use software provided by third party vendors? Can the server belong to the vendor but entries be made by employees of the company only?
This question may mistakenly arise because Reg. 3(5) of the SEBI Prohibition of Insider Trading regulations require SDD not be outsourced but maintained internally.
Listed entities and intermediaries can very much use software provided by vendors, however the installation and deployment of such software must be on an internal server owned/ controlled by the company itself or in a tenanted cloud solution that meets all the required criteria as clarified. Advanced software applications like Affinisio(SDD) structured digital database software are expertly designed to meet all these criteria.
What Regulation 3(5) restricts, and what it does not
The regulation requires that the database is not outsourced and is maintained internally, with adequate internal controls and checks. The restriction runs to where the records sit and who can reach them. It is not a restriction on who wrote the software.
The clarification of 31 March 2023
SEBI was asked the question in those terms: whether a listed company can use software provided by a third-party vendor where the server belongs to the vendor but the entries are made only by employees of the company. The answer turned on access. Where the vendor provides the software on a login basis and maintains the server, the vendor may have access to the records, and that would be contrary to the requirement that the database be maintained internally.
So the line is drawn by infrastructure rather than by authorship. A vendor’s application installed on a server the company owns and controls meets the requirement, and so does the same application deployed in the company’s own cloud tenancy: the vendor supplies the software and the company holds the records. The same application running on the vendor’s server and reached over a login does not.
Accountability does not move either. Whichever method is used, the board remains accountable for the maintenance of the database, and the board and the compliance officer are responsible for the confidentiality, integrity and security of the data and its logs. The full text of the clarifications, including the earlier position on cloud servers held outside India and how it changed, is set out in the regulatory clarifications on insider trading.
What to ask a vendor
- where the application is installed, and who owns the server or the cloud tenancy it runs in
- whether the vendor retains any access to the records
- whether entries are time-stamped as they are made
- whether the audit trail covers logins, changes and corrections, and whether it can be extracted
- whether email capture routes anything through an address outside the company
- what happens to the records, and to the logs, when the contract ends
Affinisio(SDD) structured digital database software is installed on the company’s own internal server or in its own cloud tenancy. The records and the logs remain on infrastructure the company owns and controls, and email intimations are sent through the company’s own mailboxes.
Related questions are discussed separately. On whether email capture can be automated without routing anything outside, see SDD email auto capture. On what an entry has to record, see the nature of UPSI in the SDD. On how soon the entry must follow the sharing, see when to record in the SDD.
