Security and compliance
Bank automation security and compliance
This page describes controls we implement. It does not claim certifications we have not been through, and it does not name an audit we have not had. If a control below matters to your second line, ask about it directly in the first email.
Access
Single sign-on and roles
SAML 2.0 and OIDC single sign-on from the Platform plan, with group to role mapping from your identity provider. Roles are preparer, reviewer, approver and read only, scoped by account and entity. Access reviews are supported by a role and permission export you can hand to whoever performs them.
Segregation of duties
Maker-checker, enforced
Write-offs, reversals, tolerance changes, routing changes and certifications require a second person. The system refuses a self-approval rather than logging it, and approval chains can depend on amount, account or risk.
Audit trail
Append only, with rule versions
Every action is recorded with its actor, timestamp, reason and the rule version in force. Records are not edited or deleted: a correction is a new action. Exports produce the trail for a scope and period, as it was at the time.
Data residency
Chosen, not assumed
A residency choice is available from the Platform plan, and private or VPC deployment is an Enterprise arrangement agreed during procurement. If a specific jurisdiction is a hard requirement, raise it before anything else.
Encryption
In transit and at rest
TLS for data in transit, encryption at rest for stored data and backups, with key management separated from application access. Secrets are never held in application configuration that an operator can read casually.
Retention and deletion
Configured to your policy
Retention periods are set to your record keeping obligations rather than to a vendor default, and deletion on termination is contractual. Evidence exports are available throughout the retention period.
Honesty section
What we do not claim
Every vendor page in this category is tempted to imply more assurance than it holds. Here is the line.
No certification badges
We describe controls that exist. We do not display audit or certification logos, and we will not imply an independent report exists when it does not. Ask what assurance is available and you will get a direct answer.
No customer claims
No customer names, no logos, no counts, no ratings, no testimonials anywhere on this site. Nothing here is social proof pretending to be evidence.
Not a regulated service
Bankautomation is operations software. It does not provide regulatory, legal, accounting or tax advice, and it does not make compliance determinations on your behalf.
The demo, specifically
The Reconciliation Break Resolver on this site is a marketing demo that runs on sample data. Matching happens in your browser. When you press Run, the computed break summaries are sent to a classification model through a server side proxy so the shared key is never exposed. Rows are not stored, there is no account behind the demo, and the page says so above the input. Do not paste production or customer data into it.
What the site does store is a signup: your email address, when you confirmed it, which page the signup came from and basic request metadata. That is described on the privacy page.
Incidents and questions
Security questions, vulnerability reports and questionnaire requests go to [email protected]. Reports are acknowledged within two business days. If you are reporting something sensitive, say so in the subject line and ask for a secure channel before sending detail. The contact page lists what to include so the first reply is a real answer.
- Security questionnaire responses: available during procurement.
- Architecture and data flow documentation: available under NDA.
- Subprocessor list: provided on request and kept current.
- Named contact through an InfoSec review: Enterprise.
Get started
Bring us to your security review
Create an account, and we will email you how onboarding works and what a first source connection looks like. The Reconciliation Break Resolver is open to try right now, on sample data, without an account.