Tenant isolation
The signed-in session determines the tenant. Every data access is scoped to it, and automated tests try cross-tenant reads, writes, search, files, jobs and exports.
Security
Controls built into the product, not bolted on.
Deny by default, least privilege at every boundary and evidence for every consequential action. This page describes how the platform is designed to behave.
How the platform protects your data
Authorisation in the API
Every protected action passes one authorisation check covering role, branch, portfolio, assignment, amount and workflow state. Hiding a button is never the control.
Maker-checker
Users cannot approve their own submissions or decide above their delegated authority. Administrators do not gain implicit access to credit content.
Private evidence storage
Documents live in a private store. Every upload is hashed, scanned and versioned, replacements never overwrite, and downloads go through an authorised route.
Append-only audit
Authentication, privilege, sensitive reads, exports, policy and approval events are recorded. Corrections add events and never erase history.
Careful data handling
Money is stored as integer minor units, provider credentials are envelope-encrypted per tenant, and logs redact identifiers, tokens and document content.
Controlled AI
Prompts and models are registered and approved, inputs are minimised, outputs are schema-checked and source-linked, and a reviewer sees every result. A kill switch can stop AI use.
Hardened web layer
Nonce-based content security policy, strict security headers, same-site cookies, cross-site write refusal and rate limits on sensitive routes.
Where we are today
What is and is not yet in place.
We would rather be precise than impressive. Before real borrower data enters production, the following are required and are not yet complete: an independent penetration test with remediation, a production identity provider with enforced multi-factor sign-in, a timed backup restore on the production cluster, people-run incident exercises, a manual accessibility audit and legal review for the jurisdictions served.
Third-party providers for verification, messaging, e-signature and AI are connected through adapters. Until a provider is contracted and approved, the platform uses a visibly labelled simulation or manual check. We do not currently claim any security certification.
Ask a security question