Security
Built to protect financial data
Banks and lenders trust us with their customers’ most sensitive documents. We protect them with an information security management system aligned with ISO 27001.
ISO 27001
Aligned security management system
Encrypted
Data at rest and in transit
MFA
Required for system access
Annual
Security policy reviews
Our security practice
A security program, not a checklist
Our information security management system sets how we protect customer data, and we review its policies at least once a year.
Access control
Who can reach which systems and data, and why.
Risk management
How we find, assess and treat security risks.
Change management
How changes to production are reviewed and released.
Incident response
How we detect, contain and resolve security incidents.
Keeping data secure
Protected at every layer
Customer data is protected wherever it lives, from hardened systems to encrypted storage and tightly controlled access.
Hardened systems
Systems and software hardened to industry benchmarks and kept up to date.
Encryption
Industry-standard encryption for data in transit and at rest.
Access control
Least privilege, separation of duties and multi-factor authentication, with access removed promptly when someone leaves.
Secure API access
Authenticated, encrypted API access, restricted to approved clients.
People
A security-minded team
Security starts with the people who handle your data.
Trusted team
Background checks before employment, and a code of conduct every employee signs.
Ongoing training
Regular training on our security policies and on handling security and privacy issues.
Data stays in production
Customer data is never stored on employee laptops, workstations or removable media.
Your data
How we handle data day to day
Clear rules for who owns data, how long it’s kept and who we work with.
Your data, your policy
Customer data belongs to the customer. Financial institutions on a private environment can set their own data policy.
Uploaded statements
Statements are deleted after parsing. If parsing fails, the file is kept briefly for an automatic retry, then deleted.
App data
Kept until the user deletes their account in the app, and deletion is permanent.
Backups and availability
Regular backups, with high availability and replication built in.
Monitoring
Security activity is monitored, and critical alerts are acted on immediately.
Trusted vendors
Every vendor is assessed before we work with them and reviewed each year. Any vendor with access to customer data must be ISO 27001 or SOC 2 Type 2 certified.