Credentials are encrypted, keys are hashed, tenants are isolated and every request is logged. Here is exactly how TaxBridge protects your integration.
curl -X POST https://taxbridge.themetasum.com/api/v1/invoices \
-H "Authorization: Bearer tbk_test_9f3a21c7b4d6e8f0_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 0b6d1c4e-7f9a-4a51-8d3c-2e5f7a91b204" \
-H "X-Tax-Authority: PRA" \
-d '{
"invoiceNumber": "INV-10001",
"invoiceDate": "2026-08-10T10:30:00",
"invoiceType": "Sale",
"currency": "PKR",
"paymentMode": "Cash",
"customer": { "name": "Walk-in Customer" },
"items": [{
"description": "Chicken Karahi Full", "hsCode": "11001010",
"quantity": 1, "unitPrice": 1500.00,
"taxRate": 16, "taxAmount": 240.00, "total": 1740.00
}],
"subTotal": 1500.00, "tax": 240.00, "total": 1740.00
}'Every request carries a scoped bearer key. Keys are environment-specific and optionally pinned to one authority.
Tax-authority credentials are AES-256-GCM encrypted and never returned to your application — reads are masked with a hasValue flag.
A key is shown exactly once; TaxBridge keeps only a SHA-256 hash and the last 4 characters. A lost key is regenerated, not recovered.
Every query is scoped to the company from the key or token — never from the request body — so one tenant can never see another’s data.
All API traffic is over HTTPS.
Requests and responses are logged for audit, with sensitive values redacted before any blob is stored.
Idempotency keys prevent duplicate submissions from network retries.
An authority health monitor and usage alerts surface problems early.
Role-based access in the dashboard with an audit log of administrative actions.
TaxBridge does not claim ISO, SOC, PCI or GDPR certification, and is not a government body or an official tax-authority partner unless separately stated in writing. We describe the security controls we actually implement — nothing more.
Scoped keys, encrypted credentials and tenant isolation on every request.
Just register your business with Sum Cloud POS — it already files fiscal invoices to FBR, PRA, SRB and KPRA for you. No API, no development, nothing to connect or maintain. Start selling with compliant invoices out of the box.