Security & compliance

Written for your security questionnaire.

Everything below is implemented, not planned. If your reviewer needs something that is not here, ask us directly at [email protected].

Data protection

Tenant isolation is structural: every read and write is scoped to your organisation at the query layer, covered by an automated cross-tenant test matrix. A probe with another organisation's key returns 404 — it does not reveal that the record exists.
Your API secret is stored only AES-256-GCM encrypted. The raw value exists nowhere after issuance.
Database encryption at rest, with encrypted backups.
Borrower phone and email are masked in all logs. Request and webhook bodies are never logged. Metadata-only API audit logs retain 90 days.
Webhooks contain only data about your own loans and borrowers.

Environment-locked keys — a test key is rejected on production, and a live key on sandbox.
Signature-failure lockout with alerting.
Revocation is effective in under 60 seconds; zero-downtime rotation on request.
The secret is shown exactly once at issue, and never again.
Optional hardening: IP allowlisting of your keys, plus our static egress IPs for your firewall.

We never hold or route borrower funds. Collections land directly on your rails.
Cash is not accepted — the partner app removes the option and the API rejects it.
A payment event is only emitted for money that is verifiably booked in your account.
Monthly reconciliation and remittance reporting, with CSV export.

Collections are performed under RBI fair-practices guidelines by trained and verified partners.
Your lender-of-record disclosure is printed on every borrower receipt, in wording your legal team approves at onboarding.
Borrower-facing screens are re-skinned with your logo and brand colour, so the borrower always knows whose loan it is.
Visit outcomes are recorded whatever they are, including refusals and wrong addresses.