{"id":1178,"date":"2026-09-11T10:11:51","date_gmt":"2026-09-11T10:11:51","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1178"},"modified":"2026-09-11T10:11:51","modified_gmt":"2026-09-11T10:11:51","slug":"tca-fta-security-review-uae-e-invoicing-launch","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/case-studies\/tca-fta-security-review-uae-e-invoicing-launch\/","title":{"rendered":"How TCA cleared its FTA security review and launched as a UAE e-invoicing provider"},"content":{"rendered":"\n<!-- OSTO CASE STUDY | tca-fta-security-review-v2 | replaces content at the existing live URL, keep the slug -->\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n.og .p-yes{background:var(--sage-100);color:var(--sage-700)}\n.og .p-no{background:#eef0f4;color:var(--muted)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n<div class=\"og\">\n<p class=\"dek\">Tax Compliance Agent was building the pipes UAE e-invoices will have to flow through. Before it could go live, it had to clear an FTA security review. This is how it got there with Osto, and what it has built on since.<\/p>\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Case study<\/span><\/li>\n  <li><span class=\"tag t-sage\">UAE e-invoicing<\/span><\/li>\n<\/ul>\n<div class=\"short\">\n  <p class=\"k\">TL;DR<\/p>\n  <p>Tax Compliance Agent (TCA), a bootstrapped Dubai company founded by Kanishka Garg, builds e-invoicing infrastructure for the UAE&#8217;s new mandate. Its FTA security review flagged two gaps: its APIs needed active protection, and it needed formal security documentation to the regulator&#8217;s standard. Osto onboarded TCA onto WAF and CSPM within days and got the evidence in order. The FTA security review cleared, TCA launched, and the relationship has since grown into VAPT, code security and SOC 2 work.<\/p>\n<\/div>\n<div class=\"trio\">\n  <div class=\"tcard a\">\n    <p class=\"n\">Within days<\/p>\n    <p class=\"g\">WAF and CSPM live<\/p>\n    <p>Onboarded in time for the review, in the founder&#8217;s own words.<\/p>\n  <\/div>\n  <div class=\"tcard b\">\n    <p class=\"n\">Review cleared<\/p>\n    <p class=\"g\">FTA security review passed<\/p>\n    <p>Both gaps closed, and TCA launched with the evidence the regulator asked for.<\/p>\n  <\/div>\n  <div class=\"tcard c\">\n    <p class=\"n\">6 engagements<\/p>\n    <p class=\"g\">And counting<\/p>\n    <p>From two modules to VAPT, source code review, SAST and SOC 2.<\/p>\n  <\/div>\n<\/div>\n<p>When your product is the channel a country&#8217;s invoices will move through, the regulator does not take your security on trust. It asks to see it.<\/p>\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#mandate\">A new mandate, and new pipes<\/a><\/li>\n    <li><a href=\"#tca\">What Tax Compliance Agent is<\/a><\/li>\n    <li><a href=\"#review\">What the FTA security review flagged<\/a><\/li>\n    <li><a href=\"#deployed\">What Osto put in place<\/a><\/li>\n    <li><a href=\"#results\">The results<\/a><\/li>\n    <li><a href=\"#since\">What happened after launch<\/a><\/li>\n    <li><a href=\"#lessons\">What other founders can take from this<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"mandate\">A new mandate, and new pipes<\/h2>\n<p>Under Ministerial Decisions 243 and 244 of 2025, the UAE is moving B2B and B2G invoicing onto a structured, Peppol-based electronic system. Businesses will not send e-invoices to the tax authority themselves. Every in-scope invoice passes through an accredited service provider, which validates it, transmits it to the buyer&#8217;s provider and reports the tax data onward.<\/p>\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>Phase<\/th><th>From<\/th><th>Who it covers<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Voluntary adoption<\/td><td>1 July 2026<\/td><td>Businesses that choose to go early<\/td><\/tr>\n    <tr><td>Mandatory, first wave<\/td><td>1 January 2027<\/td><td>Businesses with annual revenue of AED 50 million or more<\/td><\/tr>\n    <tr><td>Mandatory, second wave<\/td><td>1 July 2027<\/td><td>All other in-scope businesses<\/td><\/tr>\n    <tr><td>Government entities<\/td><td>1 October 2027<\/td><td>In-scope government transactions<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<p>The government is not building that layer itself. Approved providers build and run it, and the right to do so depends on satisfying the Ministry of Finance and the Federal Tax Authority that the platform can be trusted with regulated tax data. That is where TCA&#8217;s story starts.<\/p>\n\n<h2 id=\"tca\" class=\"c-sage\">What Tax Compliance Agent is<\/h2>\n<p>Tax Compliance Agent is a Dubai-based, AI-native e-invoicing company founded by Kanishka Garg. It describes its platform as FTA-accredited: businesses connect their ERP, get their invoice data into shape, and clear invoices through TCA&#8217;s Peppol-certified access point, hosted in the UAE.<\/p>\n<table class=\"h-sage\">\n  <thead>\n    <tr><th style=\"width:30%\">At a glance<\/th><th>Tax Compliance Agent<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Founder<\/td><td>Kanishka Garg<\/td><\/tr>\n    <tr><td>Headquarters<\/td><td>Dubai, UAE<\/td><\/tr>\n    <tr><td>Funding<\/td><td>Bootstrapped<\/td><\/tr>\n    <tr><td>Product<\/td><td>UAE e-invoicing platform and Peppol access point, hosted in the UAE<\/td><\/tr>\n    <tr><td>Built for<\/td><td>Small and mid-sized businesses priced out of large enterprise e-invoicing suites<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<p>The product covers the whole chain the mandate asks for: generating invoices in the structured format the government specifies, sending them over the Peppol network, reporting tax data, and storing the records securely for years. Every invoice a TCA customer sends passes through that infrastructure. A weakness there would be a tax data incident affecting every business on the platform, which is exactly why the regulator looks hard before letting a provider operate.<\/p>\n\n<h2 id=\"review\" class=\"c-plum\">What the FTA security review flagged<\/h2>\n<p>TCA was in the middle of its application in early 2026 when the FTA security review came back with two gaps. Until both were closed, the platform it had built could not go live.<\/p>\n<table class=\"h-plum\">\n  <thead>\n    <tr><th>Gap<\/th><th>Status<\/th><th>What had to be shown<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API security<\/a><\/td><td><span class=\"pill p-req\">Required<\/span><\/td><td>Active protection in front of the APIs that receive invoice and tax data, blocking injection, credential stuffing and abuse before requests reach the application<\/td><\/tr>\n    <tr><td>Security documentation<\/td><td><span class=\"pill p-req\">Required<\/span><\/td><td>Formal policies and controls evidence in the shape government assessors expect, describing a programme that actually exists<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<div class=\"callout\">\n  <p class=\"k\">Small team, regulator-grade bar<\/p>\n  <p>TCA had built the product fast with a lean team and no in-house security function. The FTA security review was asking for what a much larger company would have taken months to procure and document, and the launch waited on it.<\/p>\n<\/div>\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 20 760 190\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"How an invoice moves in the UAE model: the supplier sends it through TCA's platform, protected by Osto WAF and watched by Osto CSPM, to the buyer's provider, with tax data reported to the Federal Tax Authority.\">\n  <defs><marker id=\"tcA\" markerWidth=\"8\" markerHeight=\"8\" refX=\"6.5\" refY=\"4\" orient=\"auto\"><path d=\"M0,0 L8,4 L0,8 z\" fill=\"#4a52a8\"\/><\/marker><\/defs>\n  <rect x=\"14\" y=\"80\" width=\"108\" height=\"64\" rx=\"13\" fill=\"#e9ecfa\"\/>\n  <text x=\"68\" y=\"108\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#4a52a8\">Supplier<\/text>\n  <text x=\"68\" y=\"126\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">ERP invoice<\/text>\n  <line x1=\"126\" y1=\"112\" x2=\"144\" y2=\"112\" stroke=\"#4a52a8\" stroke-width=\"2\" marker-end=\"url(#tcA)\"\/>\n  <rect x=\"150\" y=\"80\" width=\"64\" height=\"64\" rx=\"13\" fill=\"#f0e6f3\"\/>\n  <text x=\"182\" y=\"108\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#6b4576\">WAF<\/text>\n  <text x=\"182\" y=\"126\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Osto<\/text>\n  <line x1=\"218\" y1=\"112\" x2=\"236\" y2=\"112\" stroke=\"#4a52a8\" stroke-width=\"2\" marker-end=\"url(#tcA)\"\/>\n  <rect x=\"242\" y=\"64\" width=\"210\" height=\"96\" rx=\"13\" fill=\"#1c267a\"\/>\n  <text x=\"347\" y=\"98\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"13\" font-weight=\"700\" fill=\"#ffffff\">TCA platform<\/text>\n  <text x=\"347\" y=\"118\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#b9c1e6\">Validate, transmit, report, store<\/text>\n  <text x=\"347\" y=\"136\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#b9c1e6\">Hosted in the UAE<\/text>\n  <rect x=\"262\" y=\"176\" width=\"170\" height=\"30\" rx=\"10\" fill=\"#e3f0e9\"\/>\n  <text x=\"347\" y=\"196\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" font-weight=\"700\" fill=\"#3a6f5d\">Osto CSPM watching the cloud<\/text>\n  <line x1=\"347\" y1=\"172\" x2=\"347\" y2=\"163\" stroke=\"#3a6f5d\" stroke-width=\"1.5\"\/>\n  <line x1=\"456\" y1=\"112\" x2=\"510\" y2=\"112\" stroke=\"#4a52a8\" stroke-width=\"2\" marker-end=\"url(#tcA)\"\/>\n  <text x=\"483\" y=\"104\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10\" fill=\"#4a52a8\">Peppol<\/text>\n  <rect x=\"516\" y=\"80\" width=\"112\" height=\"64\" rx=\"13\" fill=\"#e2eff7\"\/>\n  <text x=\"572\" y=\"108\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#2f6a89\">Buyer&#8217;s<\/text>\n  <text x=\"572\" y=\"126\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#2f6a89\">provider<\/text>\n  <path d=\"M452,84 C520,40 600,40 652,40\" stroke=\"#4a52a8\" stroke-width=\"2\" fill=\"none\" stroke-dasharray=\"5 4\" marker-end=\"url(#tcA)\"\/>\n  <rect x=\"656\" y=\"24\" width=\"92\" height=\"36\" rx=\"10\" fill=\"#cfd5f2\"\/>\n  <text x=\"702\" y=\"47\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#4a52a8\">FTA<\/text>\n  <text x=\"560\" y=\"36\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10\" fill=\"#4a52a8\">Tax data<\/text>\n<\/svg>\n<\/div>\n<figcaption>In the UAE model the buyer also needs an accredited provider, so a single invoice crosses two providers before its tax data reaches the FTA.<\/figcaption>\n<\/figure>\n\n<h2 id=\"deployed\" class=\"c-sky\">What Osto put in place<\/h2>\n<p>TCA came to Osto in January 2026 with two concrete asks: get real security running, and get the documentation ready to submit. Osto worked on both in parallel, because documentation only holds up in an FTA security review if it describes controls that are live.<\/p>\n<p><strong>A WAF in front of the invoice APIs.<\/strong> Osto&#8217;s <a href=\"https:\/\/www.osto.one\/resources\/glossary\/waf\/\">web application firewall<\/a> went in front of TCA&#8217;s application and API layer, inspecting every request and blocking known attack patterns and malicious payloads without any change to TCA&#8217;s code. That closed the API security gap the FTA security review had raised.<\/p>\n<p><strong>CSPM across the cloud.<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">Cloud security posture management<\/a> began scanning TCA&#8217;s environment for the misconfigurations that creep into fast-built infrastructure, such as public storage, over-permissive access, unencrypted databases and missing logging, and tracking each fix. For a platform holding regulated invoice records, that turns a potential regulatory event into a routine ticket.<\/p>\n<p><strong>Documentation built on real controls.<\/strong> Alongside the deployment, Osto produced the formal security documentation the FTA security review needed: policies, controls evidence and the structured material assessors look for, all describing what was now running in TCA&#8217;s stack.<\/p>\n<div class=\"callout c-plum\">\n  <p>&#8220;We are a registered e-invoicing vendor under the Federal Tax Authority of Dubai. Osto onboarded us onto WAF and CSPM within days, helped us get the required evidence in order, and we cleared the FTA review. Compliance certifications are next on the roadmap.&#8221;<\/p>\n  <p><strong>Kanishka Garg<\/strong>, Founder, Tax Compliance Agent<\/p>\n<\/div>\n\n<h2 id=\"results\" class=\"c-sage\">The results<\/h2>\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Outcome<\/th><th>Status<\/th><th>What happened<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>FTA security review<\/td><td><span class=\"pill p-yes\">Cleared<\/span><\/td><td>Both gaps closed with running controls and documentation, and TCA passed on submission<\/td><\/tr>\n    <tr><td>Launch<\/td><td><span class=\"pill p-yes\">Live<\/span><\/td><td>TCA went to market as a UAE e-invoicing provider<\/td><\/tr>\n    <tr><td>WAF and CSPM<\/td><td><span class=\"pill p-yes\">Running<\/span><\/td><td>In place before TCA onboarded its first paying customer, not bolted on afterwards<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<p>The FTA security review is what everyone was watching. The more useful outcome is quieter. TCA&#8217;s customers now route their invoices through a platform whose security was built to a regulator&#8217;s standard from the first day it carried live data.<\/p>\n\n<h2 id=\"since\" class=\"c-apri\">What happened after launch<\/h2>\n<p>Clearing the FTA security review was the condition for launching. It was never going to be the last security question. As more businesses route invoices through TCA, customers, auditors and the regulator all expect more, and the engagement has grown to meet that.<\/p>\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>Engagement<\/th><th>Status<\/th><th>What it covers<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">VAPT<\/a><\/td><td><span class=\"pill p-yes\">Done<\/span><\/td><td>A structured test of TCA&#8217;s application and APIs<\/td><\/tr>\n    <tr><td>Source code review<\/td><td><span class=\"pill p-yes\">Done<\/span><\/td><td>An assessment of the codebase behind the invoice pipeline<\/td><\/tr>\n    <tr><td>Code security with <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sast\/\">SAST<\/a><\/td><td><span class=\"pill p-exp\">Ongoing<\/span><\/td><td>Continuous scanning so new code is checked as it ships, not once a year<\/td><\/tr>\n    <tr><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a><\/td><td><span class=\"pill p-exp\">In progress<\/span><\/td><td>The first of the compliance certifications on TCA&#8217;s roadmap<\/td><\/tr>\n    <tr><td>Second VAPT<\/td><td><span class=\"pill p-exp\">In progress<\/span><\/td><td>A fresh round of testing as the platform and its API surface grow<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<p>The pattern is the one the review started: security that grows with the volume of data moving through the platform, run by one partner so the team stays on the product.<\/p>\n\n<h2 id=\"lessons\">What other founders can take from this<\/h2>\n<div class=\"trio\">\n  <div class=\"tcard a\">\n    <p class=\"n\">The regulator is a buyer<\/p>\n    <p class=\"g\">Of your security<\/p>\n    <p>In regulated infrastructure, the licence to operate depends on a security review, and it arrives before revenue does.<\/p>\n  <\/div>\n  <div class=\"tcard b\">\n    <p class=\"n\">Documents follow controls<\/p>\n    <p class=\"g\">Never the other way round<\/p>\n    <p>Assessors test what the paperwork says. Deploy first, then write down what is running.<\/p>\n  <\/div>\n  <div class=\"tcard c\">\n    <p class=\"n\">Launch is the start<\/p>\n    <p class=\"g\">Of the security roadmap<\/p>\n    <p>Testing, code scanning and certification follow as volume grows. Planning for that early keeps each step small.<\/p>\n  <\/div>\n<\/div>\n\n<h2 id=\"osto\" class=\"c-sky\">How Osto supports regulated launches<\/h2>\n<p>Osto is one platform built and run in one stack: web and API protection, cloud posture, endpoint, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/penetration-testing\/\">penetration testing<\/a>, code security with SAST and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sca\/\">SCA<\/a>, and compliance automation for SOC 2, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> and more than 200 frameworks. For a company facing an FTA security review or any other regulator&#8217;s assessment, that means the controls and the evidence come from the same place, and the answers to a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/security-questionnaire\/\">security questionnaire<\/a> or an assessor&#8217;s follow-up are already there.<\/p>\n<p>Osto is not the regulator or the accrediting body. It makes sure that when the review happens, there is real security to show. The certificate is a byproduct of the security, not the other way around.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Platform walkthrough<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Launch with the security review already behind you<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto deploys the controls and builds the evidence from them, so a regulator&#8217;s review finds a programme that is already running.<\/p>\n  <a href=\"https:\/\/www.osto.one\/book-demo\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 32px;border-radius:12px;margin:0;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Book a demo<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:18px 0 0;\">One platform, everything &middot; Security without slowing down<\/p>\n<\/div>\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<details>\n  <summary>What did TCA&#8217;s FTA security review flag?<\/summary>\n  <p>Two gaps. TCA&#8217;s API infrastructure needed active security protection in place, and it needed formal security documentation that met the regulator&#8217;s standard. Osto closed the first with a web application firewall and cloud posture management, and produced the documentation from those running controls.<\/p>\n<\/details>\n<details>\n  <summary>When does UAE e-invoicing become mandatory?<\/summary>\n  <p>Voluntary adoption opens on 1 July 2026. It becomes mandatory from 1 January 2027 for businesses with annual revenue of AED 50 million or more, from 1 July 2027 for other in-scope businesses, and from 1 October 2027 for government entities. Every in-scope invoice must go through an accredited service provider.<\/p>\n<\/details>\n<details>\n  <summary>What security do UAE e-invoicing providers need to show?<\/summary>\n  <p>Accreditation sits with the Ministry of Finance and the Federal Tax Authority and covers technical, security and data requirements, including Peppol certification and hosting tax records appropriately. In practice that means protected APIs, a clean cloud environment and documented controls. Certification requirements are set out in Ministerial Decision No. 64 of 2025 and should be checked against its current text.<\/p>\n<\/details>\n<details>\n  <summary>Why was WAF and CSPM the right starting point for an e-invoicing platform?<\/summary>\n  <p>Because the two biggest exposure points are the APIs receiving invoice data and the cloud environment storing it. A WAF blocks attacks on the first before they reach the application, and CSPM catches misconfigurations in the second continuously. Both produce the kind of evidence an FTA security review asks for.<\/p>\n<\/details>\n<details>\n  <summary>Does Osto accredit e-invoicing providers?<\/summary>\n  <p>No. Accreditation is granted by the UAE authorities. Osto deploys the security controls and prepares the evidence a provider needs, so that when the FTA security review or any other assessment happens, there is a real, running programme to show.<\/p>\n<\/details>\n<p class=\"related\"><strong>Related glossary terms:<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/waf\/\">WAF<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">CSPM<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API Security<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">VAPT<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sast\/\">SAST<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> &middot; <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest\/\">Encryption at Rest<\/a><\/p>\n<\/div>\n\n<script type=\"application\/ld+json\">\n{\n \"@context\": \"https:\/\/schema.org\",\n \"@type\": \"FAQPage\",\n \"mainEntity\": [\n  {\n   \"@type\": \"Question\",\n   \"name\": \"What did TCA's FTA security review flag?\",\n   \"acceptedAnswer\": {\n    \"@type\": \"Answer\",\n    \"text\": \"Two gaps. TCA's API infrastructure needed active security protection in place, and it needed formal security documentation that met the regulator's standard. Osto closed the first with a web application firewall and cloud posture management, and produced the documentation from those running controls.\"\n   }\n  },\n  {\n   \"@type\": \"Question\",\n   \"name\": \"When does UAE e-invoicing become mandatory?\",\n   \"acceptedAnswer\": {\n    \"@type\": \"Answer\",\n    \"text\": \"Voluntary adoption opens on 1 July 2026. It becomes mandatory from 1 January 2027 for businesses with annual revenue of AED 50 million or more, from 1 July 2027 for other in-scope businesses, and from 1 October 2027 for government entities. Every in-scope invoice must go through an accredited service provider.\"\n   }\n  },\n  {\n   \"@type\": \"Question\",\n   \"name\": \"What security do UAE e-invoicing providers need to show?\",\n   \"acceptedAnswer\": {\n    \"@type\": \"Answer\",\n    \"text\": \"Accreditation sits with the Ministry of Finance and the Federal Tax Authority and covers technical, security and data requirements, including Peppol certification and hosting tax records appropriately. In practice that means protected APIs, a clean cloud environment and documented controls. Certification requirements are set out in Ministerial Decision No. 64 of 2025 and should be checked against its current text.\"\n   }\n  },\n  {\n   \"@type\": \"Question\",\n   \"name\": \"Why was WAF and CSPM the right starting point for an e-invoicing platform?\",\n   \"acceptedAnswer\": {\n    \"@type\": \"Answer\",\n    \"text\": \"Because the two biggest exposure points are the APIs receiving invoice data and the cloud environment storing it. A WAF blocks attacks on the first before they reach the application, and CSPM catches misconfigurations in the second continuously. Both produce the kind of evidence an FTA security review asks for.\"\n   }\n  },\n  {\n   \"@type\": \"Question\",\n   \"name\": \"Does Osto accredit e-invoicing providers?\",\n   \"acceptedAnswer\": {\n    \"@type\": \"Answer\",\n    \"text\": \"No. Accreditation is granted by the UAE authorities. Osto deploys the security controls and prepares the evidence a provider needs, so that when the FTA security review or any other assessment happens, there is a real, running programme to show.\"\n   }\n  }\n ]\n}\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>Tax Compliance Agent was building the pipes UAE e-invoices will have to flow through. Before it could go live, it\u2026<\/p>\n","protected":false},"author":8,"featured_media":1179,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[575],"class_list":["post-1178","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","tag-fta-security-review"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1178"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1178\/revisions"}],"predecessor-version":[{"id":1180,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1178\/revisions\/1180"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1179"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}