Security
This page is for the security and vendor-risk review of a bank or platform that wants to embed FinBaze. It states what is in place, and says plainly what is not yet. Nothing here is a claim of a certification FinBaze does not hold.
At a glance#
| Where the data lives | In France, within the European Union (see EU residency). |
| Certification | None yet. ISO 27001 and SOC 2 readiness is in progress (see Certification status). |
| Penetration test | An independent test of the embed and token surfaces is planned in this release; there is no report to publish yet (see Testing). |
| Sub-processors | Listed here, generated from the published privacy policy. |
| DPA | FinBaze acts as processor for the platform's company data under a data processing agreement. |
| Status page | Linked here once it is public. |
Architecture#
- Tokens never reach your page. Components run in iframes on FinBaze's origin; the embed token stays in a hidden controller iframe and moves over private message ports. See the embed security model.
- Single-use client secrets. A secret works once, for 15 minutes.
- Origin allowlist. Components render only on the origins you register; sandbox and live origins are separate.
- Allowlisted operations. An embed token can run only the GraphQL operations FinBaze ships for the components in its session, for the one company it was created for. Arbitrary queries and introspection are refused.
- Least privilege keys. Server keys can be restricted to scopes. Key management is portal-only, so a leaked key cannot mint keys. Keys are shown once and stored hashed.
- Tenant isolation. Every operation reachable with a platform token is classified, and operations that take an id check that the caller can reach the company that owns it. Another platform's object is a 404, never a 403. A tenant-isolation test suite is being added to CI as a required check in this release.
- Consent before filing. FinBaze files for a platform company only with the authorisation of the company's own admin, recorded with the statement version and hash (Filing consent).
- Step-up for high-risk actions. Your own strong customer authentication confirms them (Delegated actions).
- Audit. Every change through an embed is recorded as "user via platform"; platforms read their companies' audit log (Lifecycle). FinBaze support sees a company only with its admin's consent. The one exception is break-glass access for a legal order or a security incident: a second FinBaze admin must approve, it is read only, lasts two hours at most, and you receive
support.break_glasswhen it starts (Support and view-as). - Webhooks. Signed with HMAC-SHA256 and a timestamp, secrets rotate without a gap, endpoints are checked against unsafe URLs (Webhook events).
- No analytics in the components. The embed app, the component library and the browser SDK load no analytics, session replay or advertising scripts. This is checked in CI.
EU residency#
Production data is hosted in France, within the European Union, on machines owned by OVH. The hosting service is provided by Auric (see the sub-processor list). Data is encrypted in transit and at rest, access is role-based and logged, and personnel access is restricted. The encryption and access statements come from FinBaze's published privacy policy and DPA; this page repeats them. The statement about who owns the machines and who provides the hosting service is added here.
Some functions use providers outside the EU (for example AI features and sign-in). The list shows each one and its purpose, and the DPA describes the transfer mechanisms. Platform companies never reach FinBaze's push provider: FinBaze sends push only to its own app for direct customers (Messages).
Backups and recovery#
The privacy policy states that backups are kept for up to three years, access-restricted and used for continuity and recovery. Scheduled backups with a tested restore, and a disaster-recovery plan with recovery point and time objectives, are part of the security work of this release; the objectives are published here when they are approved.
Sub-processors and the DPA#
The sub-processor list is generated from the privacy policy the DPA incorporates, so it cannot differ from it. FinBaze gives reasonable advance notice of a material new sub-processor and customers may object within 15 days on data-protection grounds (DPA, section 6).
Testing#
| Test | Status |
|---|---|
| Automated: access audit of every platform operation, operation manifest check, secrets scan in CI | In place |
| Tenant-isolation suite as a required CI check | Being added in this release |
| Independent penetration test of the embed and token surfaces, with a retest letter | Planned; a summary is published here when the report and the retest letter exist |
| Dependency and container scanning in CI | Being added in this release |
Certification status#
FinBaze does not currently hold an ISO 27001 certificate or a SOC 2 report. Readiness work for both has started: a gap assessment, a statement of applicability and a dated plan. When a certificate or a report exists it appears here, with its scope and date. Until then, a vendor-risk team can ask for the security questionnaire answers and the evidence the readiness work produces: write to info@finbaze.com.
Reporting a vulnerability#
Send suspected incidents or vulnerabilities to info@finbaze.com. Include the X-Request-Id of a request when you have one.