Security Center
We secure data and operations with layered controls, clear governance, and continuous monitoring—all aligned to measurable outcomes and audit readiness.
Security Governance
Policies, ownership, and oversight to align risks, controls, and accountability.
- Documented policies and standards reviewed at least annually
- Risk assessment and treatment plans with management sign‑off
- Training and awareness for employees and providers
Data Protection
Encryption, data lifecycle, and classification for customer and provider data.
- Encryption in transit (TLS 1.2+) and at rest for sensitive data
- Data classification, retention, and secure deletion procedures
- Key management with rotation and restricted access
Access Control
Identity, authentication, and authorization aligned to least privilege.
- MFA for privileged access; role‑based access (RBAC)
- Just‑in‑time elevation and periodic access reviews
- Segregation of duties for sensitive operations
Application Security & SDLC
Secure development lifecycle with testing and supply‑chain diligence.
- Threat modeling and secure code reviews
- SCA/DAST scanning and vulnerability remediation SLAs
- Dependency pinning and provenance checks
Infrastructure & Platform
Hardened environments, segmentation, and baseline configurations.
- Hardened images and CIS‑aligned baselines where applicable
- Network segmentation, WAF, and rate limiting
- Backups, tested restores, and high availability
Monitoring & Incident Response
Detection, response, and learning from events and near‑misses.
- Centralized logs, telemetry, and anomaly detection
- Playbooks, on‑call rotations, and post‑incident reviews
- Customer/regulator notification workflows as required
Vendor & Third‑Party Risk
Due diligence, contracts, and continuous oversight for service providers.
- Security questionnaires and evidence‑based reviews
- Data processing agreements and subprocessor controls
- Periodic reassessment and issue tracking
Compliance & Certifications
Alignment with relevant frameworks and industry obligations.
- Data protection practices aligned to GDPR principles
- GDP/GxP‑aware logistics processes where applicable
- Audit readiness with records and control testing
Fraud Prevention
Controls to prevent invoice fraud, account takeover, and abuse.
- Anomalous behavior detection and step‑up verification
- Immutable statement archives and settlement reconciliations
- Separation of payment initiation and approval roles
Privacy & Responsible Disclosure
Respect for personal data and a channel for security researchers.
- Purpose limitation and data minimization
- Use the contact form for responsible disclosures; mark your message as Security Disclosure
- We review good‑faith reports and coordinate remediation
Frequently asked
Do you encrypt data?
Yes. We use TLS 1.2+ in transit and encrypt sensitive data at rest with managed keys and rotation.
How is access governed?
We enforce MFA for privileged roles, RBAC, periodic access reviews, and segregation of duties.
How do you handle incidents?
We maintain playbooks, on‑call rotations, and post‑incident reviews. Customers are notified as required.
How are vendors vetted?
We perform due diligence, contract for controls, and reassess risk periodically with evidence collection.