Security & privacy
Architecture aligned to the sensitivity of financial data.
Security and privacy are design requirements. Product controls and deployment boundaries are agreed and verified for the scope of each engagement.
Product design objectives
Control objectives across the lifecycle.
These are control objectives, not a claim that every product or deployment has implemented every control.
- 01
Data minimisation and documented purpose
- 02
Encryption in transit and at rest where implemented
- 03
Role-based access and least privilege
- 04
Environment and secret separation
- 05
Logging, incident response, backup and recovery
- 06
Subprocessor and vendor governance
- 07
Retention and secure deletion
- 08
Secure-development and release controls
Deployment options
Deployment depends on context.
Possible deployment patterns may include secure cloud, client-controlled cloud, private cloud or controlled on-premise deployment. Actual availability depends on product architecture, data classification, risk and commercial scope.
Data protection
Privacy requirements need contextual review.
Privacy notices, consent or other lawful basis, processor arrangements, retention, grievance contact and data-principal rights must be reviewed against the Digital Personal Data Protection Act, 2023 and applicable commencement provisions of the Digital Personal Data Protection Rules, 2025.
Privacy & security contacts.
Build a clearer way forward