Security and Trust
Security built for evidence-sensitive work.
Review the security and data-handling information needed for an informed evaluation.
- Identity and accessCustomer configurable
- Data protectionDocumented
- Audit activityDocumented
- Deployment contextRequires confirmation
- Independent reviewAvailable on request
- Evidence availabilityAvailable on request
Illustrative control summary — no live customer data
Ask for specific evidence.
Security information should describe an actual practice, its scope, and the supporting evidence. A useful answer identifies:
- The exact control
- Its scope
- The relevant environment
- Supporting documentation
- Review date
- Any limitations or customer responsibilities
No certifications, assurances, or availability figures are claimed here. Do not infer any certification, assurance, or availability claim unless it is explicitly confirmed.
Overview
Four areas to review.
-
Access and account security
Authentication, role-based access, and account lifecycle controls.
Customer configurable View details for Access and account security -
Data protection and handling
Classification, encryption, residency, retention, and third-party access.
Documented View details for Data protection and handling -
Independent assurance
Audit practices, compliance documentation, and evidence available under confidentiality.
Available on request View details for Independent assurance -
Customer verification
Customer-conducted assessments under agreed terms.
Customer review supported View details for Customer verification
Access and account security
Who can do what, and how it is recorded.
Authentication controls
- Multi-factor authentication (MFA) is enforced for all user accounts through TOTP-based authenticator applications.
- Hardware security key support (FIDO2/WebAuthn) is available for administrator roles.
- Password policies require minimum complexity standards and automatic rotation for service accounts.
- Session timeouts are enforced after periods of inactivity, with durations configured at the organizational level.
Access management
- Role-based access control (RBAC) governs user permissions. Administrators can define custom roles with granular permissions at the feature and data-set level.
- Access logs capture authentication events, permission changes, and administrative actions with timestamp and IP attribution.
- Privileged access requires additional approval workflows and is subject to periodic access reviews.
Account lifecycle
- User provisioning and de-provisioning are managed through identity provider integrations supporting SAML 2.0 and SCIM protocols.
- Offboarding automatically revokes access tokens and invalidates active sessions upon account disablement.
Which authentication methods and integrations are available depends on the deployment and agreement. Confirm them during evaluation.
- Authentication requirement
- MFA (TOTP); hardware keys for administrators
- User role
- Custom roles (RBAC)Organization setting
- Permission scope
- Feature and data-set levelOrganization setting
- Administrative action
- Logged with timestamp and IP
- Session state
- Timeout after inactivityOrganization setting
- Provisioning status
- SAML 2.0 / SCIM via identity providerCustomer configuration
- Review record
- Periodic access reviews for privileged access
Illustrative access-control view, no live data
Identity and access flow
- 1User identity
- 2Authentication
- 3Assigned role
- 4Permitted action
- 5Recorded activity
- 6Periodic review
- Standard user
- Reviewer
- Administrator
- Privileged actionAdditional approval workflow
Exact roles, permissions, and approval workflows are confirmed during evaluation.
Data protection and handling
Five control groups.
-
Data classification
Data is categorized into tiers based on sensitivity and regulatory requirements. Customer transaction data, investigation records, and proprietary intelligence are handled under restricted access protocols. Platform analytics and telemetry data are segregated from customer content.
- Protects
- Customer transaction data, investigation records, proprietary intelligence
- Access
- Restricted access protocols
Ask about: classification tiers and handling procedures.
-
Encryption practices
Data at rest is encrypted using AES-256. Data in transit is protected via TLS 1.3. Encryption key management is handled through hardware security modules (HSMs), with key rotation schedules documented in internal security procedures.
- At rest
- AES-256
- In transit
- TLS 1.3
- Keys
- Managed through HSMs
Ask about: key management and rotation documentation.
-
Data residency and processing
Customer data is stored in regional deployments aligned with customer requirements. Processing locations are documented in data processing agreements. Backup copies are maintained in geographically separate locations with encryption maintained throughout the backup lifecycle.
- Configurable
- Regional deployment aligned with customer requirements
- Backups
- Separate locations, encrypted
Ask about: processing locations and backup arrangements.
Requires confirmation To be confirmed in the applicable agreement
-
Retention and deletion
Data retention periods are configurable by customer agreement. Automated deletion workflows remove data upon expiration of retention periods or upon verified customer request. Deletion confirmation and certificates are available upon request.
- Configurable
- Retention period, by customer agreement
- Deletion
- On expiry or verified customer request
Available on request: deletion confirmation and certificates.
Requires confirmation To be confirmed in the applicable agreement
-
Third-party access
Customer data is not used to train machine learning models without explicit contractual agreement. Subprocessors with access to customer data are listed in the subprocessor documentation and are subject to contractual security obligations.
- Boundary
- No model training without explicit contractual agreement
- Subprocessors
- Listed in subprocessor documentation
Ask about: subprocessor documentation.
Requires confirmation To be confirmed in the applicable agreement
Data lifecycle
From receipt to deletion or return.
- 1Data received
- 2Classified
- 3ProtectedEncryption
- 4Accessed by authorized usersPermission checksAudit activity
- 5Retained according to requirementsRetention policy
- 6Deleted or returned under agreed conditionsVerified deletion request
Requires confirmation Customer-specific terms and timelines: To be confirmed in the applicable agreement.
Independent assurance
Evidence, under agreed terms.
Audit practices
Third-party security firms are engaged to perform penetration testing and vulnerability assessments on an annual basis. Scope includes external-facing infrastructure, API endpoints, and web applications. Findings are tracked through remediation with internal security and engineering teams.
Compliance documentation
Security policies and procedures are maintained in a controlled documentation system subject to version control and periodic review. Customers may request review of relevant security documentation under confidentiality agreement.
Customer verification
Customer-conducted security assessments, including vulnerability scanning of exposed endpoints and review of security documentation, are supported under agreed terms and mutual non-disclosure agreements.
Evidence register
| Evidence category | Scope | Review period | Availability | Confidentiality | Request status |
|---|---|---|---|---|---|
| Penetration testing summary | External infrastructure, API endpoints, web applications | To be confirmed | Available on request | Subject to NDA | Scope must be confirmed |
| Security questionnaire responses | Specific due diligence questions | To be confirmed | Available on request | Subject to NDA | Scope must be confirmed |
| Control operation artifacts | Specific security claims | To be confirmed | Available on request | Subject to NDA | Scope must be confirmed |
| Security policies and procedures | Controlled documentation system | To be confirmed | Available on request | Subject to NDA | Not publicly published |
| Customer-conducted assessment | Exposed endpoints and documentation | To be confirmed | Customer review supported | Subject to NDA | Scope must be confirmed |
Illustrative register layout, no live data. It does not confirm any report, audit, or attestation.
Evidence requests
What you can ask about.
Documentation is not automatically public. Items below are available on request under agreed terms, or are topics to raise during evaluation.
Security policies and guidelines
Available on requestRelevant control documentation
Available on requestPenetration-testing summary
Subject to NDAArchitecture or data-flow information
Ask during evaluationAccess-control information
Ask during evaluationSubprocessor documentation
Available on requestRetention and deletion information
Available on requestDeployment information
Ask during evaluation
- 1Identify the required evidence
- 2Confirm the evaluation scope
- 3Apply confidentiality requirements
- 4Share approved documentation
- 5Record follow-up questions
Shared responsibility
Security depends on both sides.
FinTrace responsibilities
- Platform controls
- Documented operating procedures
- Access and audit capabilities
- Approved evidence provision
Customer responsibilities
- User administration
- Role and permission configuration
- Credential protection
- Internal review processes
- Integration and endpoint security
Exact responsibilities depend on the selected deployment and the applicable agreement.
Customer security review
Prepare for your evaluation.
These questions help focus a security review. They are preparation guidance, not a statement that every requirement is supported.
- Which product and environment are being reviewed?
- What data would be processed?
- Which users and roles require access?
- Which identity integrations are required?
- What deployment model is being considered?
- Which residency or retention requirements apply?
- What documentation does the security team need?
- Is an NDA or formal assessment required?
Security contact
Reach the security route.
- Security documentation requests
- Customer assessment coordination
- Responsible vulnerability disclosure
- General security questions
For specific evidence requests, compliance documentation, or to initiate a security review, contact:
security@fintraceintelligence.comor your designated account representative.
Vulnerability disclosure policyReview the evidence your security team needs.
Tell us the environment, controls, and documentation required for your evaluation.