Singapore Corporate Secretary FAQ

Under the Singapore Companies Act, every locally incorporated company must appoint a corporate (company) secretary. This is a mandatory statutory office that cannot be left vacant long-term. The appointment must be made within 6 months of incorporation, and any vacancy must be filled within 6 months. The secretary must be a natural person who is ordinarily resident in Singapore and is responsible for maintaining statutory registers, preparing board and shareholder documents, and handling filings with ACRA. For private companies there is no mandatory professional qualification, whereas public companies must appoint a qualified secretary. Most SMEs outsource this function to a corporate service provider (CSP) to ensure ongoing compliance and avoid penalties.

Corporate secretary services in Singapore generally cost between S$300 and S$800 per year. The range depends on the complexity of your structure (number of directors/shareholders, foreign ownership), the volume of annual filings and resolutions, and whether extras such as a registered address, nominee director or bookkeeping are bundled in. A basic package usually covers the Annual Return, AGM documents and routine resolutions; one-off matters such as share transfers, capital increases or name changes are typically charged per transaction. Beyond price, buyers should weigh responsiveness, compliance accuracy and audit traceability. CorpSec.app uses AI to auto-generate compliance documents, cutting drafting cost and turnaround at the same compliance quality.

Switching corporate secretary usually takes four steps: the new provider completes KYC on the company and its directors/shareholders; the current secretary submits a resignation; the board passes a resolution appointing the new secretary; and the change is filed via ACRA BizFile within 14 days of taking effect. The process does not normally disrupt operations and does not require a shareholders' meeting. During the switch, obtain the full statutory registers, historical resolutions, the constitution and past Annual Returns from the outgoing provider so the compliance trail is unbroken. If you are also changing the registered address, file that at the same time. When selecting a new provider, confirm they can seamlessly take over historical records and provide a handover checklist.

A corporate secretary and a nominee director are entirely different roles. The corporate secretary is a mandatory statutory office responsible for maintaining statutory registers, preparing board and shareholder documents, and filing with ACRA; the secretary does not make business decisions and does not bear directors' liabilities. A nominee director, by contrast, is a genuine director — typically appointed to satisfy Singapore's requirement for at least one director ordinarily resident locally, common for foreign-owned companies. A nominee director carries the legal duties and potential liabilities of a director, which is why the fee is far higher and usually accompanied by an indemnity and disclaimer agreement. The two cannot substitute for each other, and many foreign-owned companies appoint both.

Traditional CSPs draft each resolution, form and filing by hand, which is slow and sensitive to staff turnover. CorpSec.app breaks the corporate-secretary workflow into seven standard building blocks — form, document, verification, approval, signing, filing and data update. Users describe a need in natural language (e.g. "a director is resigning"), and the AI generates the full document set and threads the workflow, with humans confirming only at key checkpoints — often typing just once. The platform has built-in Singapore compliance-rule checks, L1 data masking and a complete audit log, and manages many clients in one place. Compared with the traditional model it is faster, traceable and more consistent at scale — especially for CSP teams managing large volumes of companies.

In compliance work, AI's role is to draft and accelerate, not to replace professional judgement. CorpSec.app's design principle is "AI does the work, the user confirms": documents are AI-generated, but the approval and signing steps are locked to human execution, while verification and data updates are auto-checked by the system. Every document is reviewed by a professional before it is filed with ACRA, and the platform keeps a complete audit log of every step so responsibility is traceable and changes are reversible. Final legal and compliance responsibility still rests with the licensed service firm and the signatories — the AI provides efficiency and consistency, not a transfer of liability. This human-in-the-loop split is exactly what makes the platform usable in compliance-sensitive settings.

A corporate secretary must be a natural person ordinarily resident in Singapore (a corporate entity cannot hold the office). For private limited companies there is no mandatory professional qualification — directors must reasonably ensure the appointee is capable — and in practice the role is usually filled by a licensed CSP's professionals or an experienced compliance person. For public companies the bar is higher: the secretary must hold a prescribed qualification, such as a chartered secretary, lawyer, accountant, or someone with relevant experience. In addition, a company's sole director cannot also act as that company's secretary — a common misconception. When outsourcing, confirm the provider's team has the experience and qualifications needed for your company type.

In Singapore a director may also serve as the company's secretary, with one key restriction: where a company has only one director (a sole director), that director cannot simultaneously act as the company secretary, and a separate qualifying secretary must be appointed. This rule prevents one person from controlling both the director and secretary functions without any internal check. For small companies with a single director who is also the shareholder, it means appointing or designating another locally resident person as secretary — a direct reason many micro-businesses outsource the secretary function to a CSP. If the company has two or more directors, one of them may serve as secretary (provided they are a local resident and not the sole director).

Annual compliance for a Singapore company runs on two lines. The ACRA line: eligible private companies must hold or be exempt from an AGM, file the Annual Return within the prescribed window, and attach financial statements (some in XBRL) where required. The IRAS line: file the Estimated Chargeable Income (ECI) within 3 months after the financial year end (with exemptions), and submit the corporate tax return (Form C / C-S / C-S Lite) by 30 November each year. Companies must also maintain statutory registers on an ongoing basis (members, directors, registrable controllers, etc.). Because these deadlines interlace and each carries penalties for lateness, most companies have their corporate secretary schedule and execute them centrally.

Since the 2018 filing reforms, AGM and Annual Return deadlines are anchored to the financial year end (FYE). Non-listed private companies must hold the Annual General Meeting (AGM) within 6 months after FYE and file the Annual Return (AR) with ACRA within 7 months after FYE. Listed companies have shorter windows (4 months for the AGM and 5 months for the AR). Eligible private companies may be exempt from holding an AGM if they send financial statements to all members, or if they are dormant/exempt and meet the conditions. The Annual Return confirms company particulars, share capital and financial-statement status. Late filing of the AR incurs escalating penalties and directors may be held responsible, so schedule from the FYE date.

Singapore has a clear penalty regime. If the corporate secretary position stays vacant for more than 6 months, the company and its directors may be fined. Late filing of the Annual Return triggers a fixed late-lodgement fee that escalates with the length of the delay — the longer the lateness, the higher the fee. Continued non-filing can see directors prosecuted, fined, or even disqualified, which affects their ability to hold office in other companies. Repeated breaches can also lead ACRA to strike the company off the register. Beyond direct costs, these penalties leave a poor compliance record that affects bank account opening, financing and business reputation. Timely, continuous compliance is the only way to avoid these outcomes.

A dormant company (one with no accounting transactions during the period) is still a live, registered company, so it must appoint a corporate secretary, maintain a registered address and statutory registers, and meet its annual filing obligations. The difference is that a qualifying dormant company can enjoy simplified compliance — for example, exemption from preparing audited financial statements, a simplified Annual Return, and in some cases exemption from preparing financial statements at all. However, the AGM/Annual Return filing obligation and the requirement to have a secretary are not waived. If the company is unlikely to trade again, rather than keep bearing dormant-period compliance costs, consider a formal strike off. Whether to stay dormant depends on the likelihood of restarting the business.

Every Singapore company must have a local registered address as the official place to receive government and legal documents. The address must be a physical location within Singapore — a PO box is not allowed — and must be open to the public for the prescribed hours (at least 3 hours) on each business day. The registered address appears on ACRA's public records. A residential address may be used as a registered address if it qualifies under the URA/HDB Home Office Scheme. For privacy and a professional image, many companies use a registered-address service provided by their corporate secretary, usually bundled with the secretary package. A change of registered address must be filed with ACRA within 14 days of taking effect.

Since 2015, Singapore has applied a "small company" audit exemption. A private company is exempt from statutory audit if, in each of the immediately preceding two financial years, it meets at least two of these three thresholds: annual revenue not exceeding S$10 million, total assets not exceeding S$10 million, and no more than 50 employees. If the company belongs to a group, the whole group must also qualify as a "small group" for the exemption to apply. Being audit-exempt does not remove the need to keep accounts and prepare financial statements — the company must still maintain records and prepare FS that comply with accounting standards. Because audit status affects annual compliance cost, review these three thresholds continuously as the business grows.

To improve corporate transparency and combat money laundering, Singapore requires most companies and foreign companies to set up and maintain a Register of Registrable Controllers (RORC). A controller is generally an individual or entity that directly or indirectly holds more than 25% of shares or voting rights, or that has significant control or influence over the company. A company must set up the register within 30 days of incorporation, identify and record controller information, and lodge that information with the central register maintained by ACRA; it must update the register promptly when details change. This obligation is usually handled by the corporate secretary, including sending controller notices, verifying identities and keeping records. Failing to maintain the RORC is an offence and can be penalised. Few entities are exempt (e.g. listed companies, financial institutions).

Singapore companies must continuously maintain a set of statutory records evidencing their governance and compliance. Core items include the register of members (shareholders), the register of directors and CEOs, the register of secretaries, the Register of Registrable Controllers (RORC), and the register of nominee directors, plus records relating to shares and charges. Companies must also keep minutes of board and shareholders' meetings, the resolutions passed, and accounting records and supporting documents for at least 5 years. Since 2022, the way the register of members is maintained changed for private companies, with ACRA's electronic register serving as the statutory register. These records are usually set up and updated by the corporate secretary and underpin audits, due diligence, financing and regulatory queries. Missing or inaccurate records can constitute a breach.

XBRL (eXtensible Business Reporting Language) is the structured financial-statement format ACRA requires. Most companies incorporated in Singapore that are required to prepare and disclose financial statements must file those statements in XBRL when submitting the Annual Return, so regulators can read and analyse them in a structured way. The exact format (Full XBRL, Simplified XBRL, or Financial Statements Highlights) depends on company type, audit-exemption status and size. Solvent exempt private companies (EPCs) may, in some cases, be exempt from filing financial statements or may file a simplified version. Preparing XBRL involves mapping financial-statement line items to ACRA's taxonomy — a non-trivial task usually done by the accounting or corporate-secretary team. Choosing the wrong format causes the Annual Return to be rejected and delays the filing.

Director changes (appointment or resignation) follow a standard, time-bound process. To appoint a director: confirm they are eligible (at least 18, not disqualified, and locally resident if they are the sole director), obtain their written consent, pass a board or shareholder resolution, then update the register of directors and file with ACRA. To resign a director: confirm the company will still have at least one director meeting the residency requirement after the resignation (otherwise it cannot take effect), submit the resignation letter, pass a resolution, update the register and file. Both cases must be filed via ACRA BizFile within 14 days of taking effect, with penalties for lateness. CorpSec.app can auto-generate the consent, resolution and filing documents, so users typically just confirm and enter the ACRA reference number.

A share transfer spans company law and tax. On the company side: the transferor and transferee sign the instrument of transfer, the board passes a resolution approving the transfer (satisfying any transfer restrictions or pre-emption rights in the constitution first), the old share certificate is cancelled, a new one issued, the register of members updated, and the change reported to ACRA. On the tax side: stamp duty is payable on the transfer, generally 0.2% of the higher of the consideration and the net asset value (NAV) of the shares, paid by the transferee via IRAS's e-Stamping system within 14 days of signing, with penalties for lateness. The corporate secretary usually coordinates the full document set and filings. Where foreign parties or valuation disputes are involved, assess the stamp-duty basis in advance.

Singapore uses a no-par-value share regime, so raising capital is usually done by allotting new shares. The process: confirm the constitution and any shareholders' agreement allow it and whether existing shareholders' pre-emption rights apply; pass a board (and where needed shareholder) resolution approving the number of shares, price per share and the subscribers; upon receipt of the subscription monies, issue the new share certificates, update the register of members, and file the "Return of Allotment" via ACRA BizFile within 14 days of the allotment, after which the issued share capital and shareholding percentages are updated. Throughout, record contributions and shareholding changes accurately to avoid later equity disputes. CorpSec.app can generate the resolution, allotment forms and filing documents for the scenario in one click, with the user simply confirming.

Changing a company name takes three steps. First, submit a name application in ACRA BizFile for the intended new name, confirming it is not already taken and does not contain restricted or sensitive words (the latter may need referral to the relevant authority). Second, convene shareholders to pass a special resolution (at least 75% of voting rights) approving the change. Third, file the name change with ACRA; once approved, the new name takes effect immediately and ACRA issues a notice of change. After the change, the company must update its seal, signage, letterhead, invoices, bank accounts, contracts and licences with the new name — the registration number (UEN) stays the same. Although the process is straightforward, synchronising all external information afterwards is significant work, so prepare a checklist of what needs updating.

The financial year end (FYE) drives the timing of the AGM, Annual Return and tax filing, and can be changed, subject to rules. The company files the new FYE via ACRA BizFile. ACRA approval is generally required where: the change results in a financial year longer than 18 months, or the company has already changed its FYE within the past 5 years. Companies also cannot arbitrarily extend the FYE to avoid filing obligations. Changing the FYE has a knock-on effect on all AGM/Annual Return/tax deadlines, and may affect the period in which tax incentives apply, so it should not be adjusted frequently. Common legitimate reasons include aligning with a parent company's financial year or matching business seasonality. Before changing, have the corporate secretary assess the overall impact on compliance timing and tax.

A company's principal business is registered at incorporation using the Singapore Standard Industrial Classification (SSIC) code, with up to two principal activities. When the actual business changes, update the SSIC so ACRA's records match reality. The process: select the code from ACRA's SSIC list that best fits the new business, file the change of business activity via BizFile — generally effective immediately and without a shareholders' resolution. Note that some industries are regulated activities (e.g. finance, education, food & beverage, travel), and changing or adding to those SSIC codes may trigger additional licensing or approval requirements. A business scope that does not match actual operations can affect banking, tax and licensing compliance, so update the SSIC whenever the business pivots.

As a licensed entity subject to anti-money-laundering (AML/CFT) rules, a corporate service provider (CSP) must complete KYC / customer due diligence (CDD) before onboarding a client. This usually means collecting: identity proof (passport / ID) for all directors, shareholders and beneficial owners (UBOs), proof of residential address (e.g. utility bill, bank statement), and the company's registration details and a description of its business; for corporate shareholders, ownership must be traced through to the ultimate natural persons. High-risk situations (e.g. complex cross-border structures, politically exposed persons) trigger enhanced due diligence (EDD). This information is used to verify identity, assess risk and be retained for records — a compliance step, not needless friction. Once documents are complete, appointment usually takes 1–2 business days. CorpSec.app supports L1 data masking, so sensitive ID numbers are masked in both display and AI context.

Appointing a corporate secretary is itself a quick process; most of the time is spent on the up-front due diligence. Once the provider has completed KYC on the company and relevant persons and gathered the necessary documents, the formal appointment (preparing the consent, passing the resolution, updating the register and filing with ACRA) usually completes within 1–2 business days. For newly incorporated companies, the secretary appointment often happens alongside incorporation; for existing companies switching providers, speed also depends on how quickly the outgoing provider hands over historical records. Where documents are incomplete, structures are complex and cross-border, or enhanced due diligence is needed, the timeline extends accordingly. Using an automated platform (such as CorpSec.app) markedly compresses the drafting and preparation stages, so professionals spend their time reviewing and confirming.

Foreigners may own 100% of a Singapore private limited company, but incorporation must meet several local requirements. The core one is at least one director "ordinarily resident in Singapore" (a citizen, PR, or holder of a valid work pass), so a foreign founder not based locally usually appoints a nominee local director; plus a local corporate secretary, a local registered address, and a minimum paid-up capital of S$1. All directors, shareholders and beneficial owners must complete KYC. If the founder wishes to relocate and run the business, they can apply for an Employment Pass (EP) or EntrePass and, once approved, serve as a local director themselves. Most foreign founders use a single CSP to handle incorporation, local director, secretary and address in one place. Incorporation itself usually takes 1–3 business days once KYC and documents are ready.

Singapore is known for efficient incorporation. Provided the name is approved and KYC and documents are ready, incorporation usually completes within 1–3 business days; complex cases or regulated industries may take longer. Fees fall into two parts: fixed ACRA government fees, comprising about S$15 for the name application and about S$300 for incorporation, totalling roughly S$315; plus the provider's incorporation service fee and any first-year secretary, registered-address and other bundled charges, depending on the package. Once incorporated, you receive a UEN (Unique Entity Number) and a certificate of incorporation. What usually affects timing is not incorporation itself but the up-front KYC, name approval (referral needed if it contains sensitive words) and bank account opening. Prepare director/shareholder details and a business description in advance to shorten the overall timeline.

The Singapore Companies Act requires every company to appoint at least one director "ordinarily resident in Singapore". Those who typically qualify are Singapore citizens, permanent residents (PRs), or holders of a valid pass (such as an EP or EntrePass) with a local place of residence. This is a hard requirement — the company can never be without a locally resident director; if the sole local director resigns, a replacement must be in place for it to take effect. For foreign founders without a suitable local candidate, the common approach is to appoint a nominee local director to satisfy this requirement, together with an indemnity and disclaimer agreement. Directors must be at least 18, not bankrupt, and not disqualified. The local-director requirement, along with the corporate secretary and registered address, forms the three basic local requirements for a foreigner incorporating in Singapore.

To improve ownership transparency, Singapore requires companies to identify and report their ultimate beneficial owners (UBOs) / registrable controllers. Even where a nominee shareholder holds shares on behalf of another, the true beneficial owner's identity cannot be hidden: the company must trace through to the ultimate natural person via due diligence, record them in the Register of Registrable Controllers (RORC), and lodge the information with the central register maintained by ACRA. The nominee arrangement between the nominee shareholder and the beneficiary must also be accurately recorded in the register of nominee shareholders. This information is not public but can be accessed by regulators and enforcement agencies. Hiding beneficial owners to evade reporting is a breach and can be penalised. The corporate secretary usually issues controller notices, verifies identities and maintains the registers to keep transparency compliance in order.

There are two main routes to close a Singapore company. Strike off: suitable for a company that has ceased business, has no assets or liabilities, no pending legal proceedings and has settled its taxes; the directors apply to ACRA to deregister, and after ACRA reviews and gazettes the application, if there is no objection the company is struck off within a few months — the cheapest and most common route. Winding up (liquidation): suitable for a company with assets and liabilities to be dealt with or a more complex situation; it can be a members' voluntary, creditors' voluntary or court winding up, requiring a liquidator to realise assets, settle debts and distribute the surplus — a longer, costlier process. Either way, before closing, complete all outstanding ACRA/IRAS filings, settle taxes and close bank accounts. The corporate secretary can help prepare the resolutions and filing documents.

You do not need to fly to Singapore to set up the company. A licensed corporate service provider (CSP) can complete identity verification (KYC) remotely, have you sign the incorporation documents electronically, and file with ACRA online — the whole process is commonly done without the founder ever entering Singapore. The one step where physical presence sometimes still matters is corporate bank account opening: policies differ by bank, with some accepting video interviews and others preferring or requiring an in-person meeting. Digital banks and fintech alternatives generally onboard fully online. Plan the banking route before incorporation if you cannot travel, and confirm current requirements directly with the bank, as policies change.

The Employment Pass (EP) is Singapore's main work pass for professionals, applied for by a Singapore-registered employer on behalf of the candidate. What agents in the Chinese market call a "self-employed EP" (自雇EP) is not a distinct visa type: it simply means you incorporate a Singapore company first, and that company — as your employer — sponsors your EP application. MOM assesses such applications under the same framework as any EP: the prevailing qualifying salary, the COMPASS points system, your qualifications and experience, and importantly whether the company has genuine business substance (real activity, reasonable capitalisation, a credible business plan). Applications from newly incorporated shell companies with no real operations face obvious scrutiny. For current salary thresholds and criteria, rely on MOM's official website rather than agent marketing materials.

Foreign founders commonly appoint a nominee local director to satisfy Singapore's resident-director requirement. The risks run both ways. For the nominee: they are a genuine director under the Companies Act, bearing full statutory duties (acting honestly, exercising reasonable diligence, ensuring filings and solvency obligations are met) and potential personal liability — this is why nominee services are priced well above secretary services and are always accompanied by indemnity and disclaimer agreements. For the owner: the main risks are using an unlicensed or informal provider (a personal acquaintance "helping out"), unclear scope of the nominee's authority, and disputes over bank signing rights. Under Singapore's CSP Act 2024 regime, providing nominee director services by way of business requires a licensed CSP, and the nominee must be registered and assessed fit and proper. Choose a licensed provider, keep the nominee's role passive and documented, and retain control of banking and operations yourself.

Singapore's corporate tax system is simple by regional standards. Corporate income tax is a flat 17% on chargeable income, and qualifying companies enjoy partial tax exemption — and new companies a start-up exemption — on the first tranches of income, which materially lowers the effective rate for SMEs (exact bands and amounts per IRAS). There is no capital gains tax, and under the one-tier system dividends distributed by a Singapore tax-resident company are generally not taxed again in the shareholder's hands. Goods and Services Tax (GST) registration becomes compulsory once annual taxable turnover exceeds the statutory threshold (currently S$1 million — verify the current figure and rate with IRAS). Companies file an Estimated Chargeable Income (ECI) within 3 months of financial year end (exemptions apply) and the annual return Form C-S/C by 30 November. Foreign-sourced income and cross-border structures have their own rules — take professional advice for anything beyond a plain domestic operating company.

This is a China-side regulatory question, not a Singapore-side one. When a mainland-Chinese company makes an outbound direct investment (setting up or acquiring a company overseas, including in Singapore), it generally must complete China's ODI process: filing or approval with the NDRC (发改委) and MOFCOM/commerce authorities (商务部门), followed by foreign-exchange registration handled through the remitting bank under SAFE rules. Only then can investment capital be remitted out through the capital account. Incorporating the Singapore company itself does not require ODI paperwork — ACRA does not ask for it, and many structures incorporate first and fund later. But the practical checkpoints are the banks: both the Chinese remitting bank and the Singapore receiving bank will ask about the source and pathway of funds. Individual (natural-person) investors are not covered by corporate ODI and face a different, more restrictive foreign-exchange regime. Requirements, thresholds and sensitive-sector lists change — verify the current rules with the Chinese authorities and qualified cross-border advisors.

Two facts remove most of the urgency. First, Singapore's minimum paid-up capital is S$1 — you can incorporate now and inject capital later, so funding does not block registration. Second, what matters to every bank involved is a clean, documentable source of funds. Compliant paths include: a Chinese corporate investor remitting capital under a completed ODI filing; funding from money you already hold lawfully offshore (e.g. overseas salary, offshore business profits, proceeds with a clear paper trail); or reinvesting the Singapore company's own earnings. China's individual foreign-exchange regime has its own limits and declared-purpose rules — the annual individual facilitation quota is not designed for outbound capital investment, so personal remittances labelled as such can be refused or create later problems. Avoid underground banking and "split remittance" arrangements entirely: they breach Chinese rules and, on the Singapore side, funds without a credible source fail bank KYC and AML screening. When the capital arrives, your corporate secretary completes the share allotment and ACRA filing so the paid-up capital is properly recorded.

The concern is reasonable, and the honest way to answer it is to say exactly what happens to the file. When a document or scanned ID enters CorpSec.app, it is sealed in its own individual encrypted envelope before it is written to storage. Each file gets a unique, single-use key; that key is then locked with a key belonging only to your firm; and your firm's key is derived from a master key held outside the database entirely. Someone who obtained a full copy of the database and the file store would hold scrambled bytes, not a passport. The envelope is also bound to your firm and to that file's own fingerprint, so a sealed file lifted into another firm's account will not open. If the key is ever unavailable, the system refuses to save the file rather than storing it unprotected. It is also worth comparing against the real alternative: identity documents arriving by WhatsApp and sitting in a laptop folder are unencrypted, uncontrolled, and leave no record of who opened them.

The application runs in Vercel's Singapore region (sin1) and the database, authentication and file storage run on Supabase — so a Singapore firm serving Singapore clients has no cross-border transfer question to answer. On AI: data sent to the model is used solely to complete the specific request you made, and is never used for model training, fine-tuning or evaluation, by us or by our providers. Identity numbers are masked before anything reaches the model — the AI sees S****567A, never the full number. Raw identity documents are never sent to an external AI at all: text is extracted and redacted locally first, and a scan that cannot be read safely is routed to manual entry rather than to an external vision model.

We would rather lose a deal than overstate a certification. Today CorpSec.app holds neither SOC 2 Type II nor ISO/IEC 27001, and no third-party penetration test has been performed. What is in place: application-layer envelope encryption applied by our own code, Singapore data residency, three independent layers of tenant isolation including a database that denies client writes by default, an append-only audit trail, four-eyes approval, and an automated test suite that runs on every change and includes tests which deliberately attempt to bypass each control — but that is our own testing, not a third party's opinion. Backups are the managed backups on our hosting plan; we have not run a timed full-restore drill, so we publish no recovery-time guarantee. If a current certificate is a hard requirement for your firm or your bank today, we are not yet the right fit, and we will tell you that rather than sell around it.

Your records are yours and leaving should be a decision you can execute in an afternoon. From Settings, an admin can export the whole firm three ways: JSON (a full snapshot of companies, officers, tasks and their workflow state, KYC dossiers, invoices and billing, fee schedule, documents and an audit summary), CSV (the ACRA-style registers of companies and officers), or ZIP (the JSON and CSVs plus every generated document file, with a manifest). Generated documents are ordinary .docx files that open anywhere. Identity numbers in exports are masked by default; an admin can produce an unmasked export with an explicit confirmation, and that stronger action is itself written to the audit log. Because you can take a full copy whenever you like, your own export is also a backup that no vendor can take away from you.