Access control
Everyone signs in with a password and a second step from an authenticator app. The second step is always on and cannot be switched off.
People only see and open the screens their role includes, and inactive sessions end automatically after a warning.
Audit trail
Alerts, cases, customer files and policy changes keep their own history: what happened, who did it, when, and the reason they gave.
Records can be exported into board and examination packs so you can evidence decisions to a regulator.
Change control
Changes to your risk policy are tested on sample customers in a sandbox before they go live. Sensitive changes need a second approver, and every version is kept.
Application privacy
The app loads everything from its own servers and uses no third-party trackers or advertising scripts. See the Privacy Policy for how data is handled.
Infrastructure and data
- Hosting provider and regions: [confirm]
- Encryption in transit and at rest: [confirm standards]
- Backups and recovery objectives: [confirm]
- Data separation between customers: [describe]
Assurance and certifications
[List audits, certifications and penetration-test cadence you hold, or remove this section]
Incidents and disclosure
If you believe you have found a vulnerability, email [security@yourdomain]. We will acknowledge your report and keep you informed as we investigate.
How we notify customers of an incident that affects their data: [describe process and timeframe].