Security that banks can trust
Fincarna handles pricing and billing data for financial institutions, so encryption, access control, and an audit trail are part of every layer rather than added later.
Security architecture
Fincarna’s security model is designed for regulated financial institutions. We assume zero trust across every boundary: between services, between tenants, and between users. Data is encrypted at every stage, access is controlled at every level, and every action is logged.
Encryption
At rest
- All data encrypted using AES-256
- Database-level encryption with customer-managed keys (CMK) for private cloud and on-prem
- Backup encryption with separate key rotation
In transit
- TLS 1.3 for all external communication
- Mutual TLS (mTLS) available for API integrations
- Internal service-to-service encryption via service mesh
Key management
- Keys managed through AWS KMS or your HSM
- Automatic key rotation on configurable schedules
- Key access audited and logged
Access control
Role-based access (RBAC)
- Predefined roles: Admin, Pricing Manager, Analyst, Auditor, API Consumer
- Custom roles with granular permission sets
- Permissions scoped to specific resources
Authentication
- SAML 2.0 and OIDC integration (Okta, Azure AD, Ping)
- MFA enforced for all dashboard access
- OAuth 2.0 client credentials for API access
- API keys with IP allowlisting for batch integrations
Session management
- Configurable session timeout
- Automatic termination on inactivity
- Concurrent session limits per user
Audit trail
Every action in Fincarna is logged. Every pricing model change, every promotion enrollment, every fee calculation, every configuration update, every login. Logs are immutable, timestamped, and include the full context of the action.
Configuration changes
Full diff of before/after state for every pricing model, fee schedule, and promotion change
Billing events
Complete calculation trace: inputs, rule applied, output, account affected
User activity
Login, logout, permission changes, data access, export requests
API access
Every API call logged with request/response metadata, caller identity, and timestamp
Compliance readiness
Security-first architecture
AES-256 encryption at rest, TLS 1.3 in transit, tenant isolation, and immutable audit logs, all baked in from day one.
Data residency
Data residency in the country of your choice. Cloud-hosted deployments run on isolated, region-specific AWS infrastructure.
Regulatory alignment
Built to support regulatory expectations for technology and cyber risk management across financial jurisdictions.
Regional compliance
Configurable to meet the requirements of your local financial regulator, wherever your institution operates.
Penetration testing
Regular third-party security assessments by independent firms.
Vulnerability management
Automated dependency scanning, container image scanning, and a responsible disclosure program.
Tenant isolation
In shared deployments where multiple institutions operate on one platform (such as a central or consortium offering Fincarna to member institutions), each tenant’s data is logically and cryptographically isolated. Separate encryption keys per tenant. Separate database schemas. No shared state between tenants. A compromise in one tenant cannot access another tenant’s data.
For institutions that require physical isolation, dedicated and private cloud deployments provide completely separate infrastructure.
Security questions? Let’s talk.
We’re happy to walk through our security architecture in detail or review your specific compliance requirements.