Security

1. What we protect and why it matters

Financore Platform receives credit reports, identity documents, and Social Security numbers of the firms' clients. A leaked SSN cannot be changed like a password, and the harm is suffered by a person who does not even have an account with us. That is why this information governs all security decisions.

2. Separation between firms

Every data query is limited to the organization of the session, not to what the request says. A firm cannot open another firm's client file: each firm's data is queried only from its own account.

3. Encryption

• Passwords: they are stored using a key derivation method with a unique salt. No one, including us, can read them.
• Sensitive data (client files, analyses, contracts, reports, client contact information, monitoring credentials, and documents): it is encrypted with AES-256-GCM before being stored, and the key is stored separately, outside the code and the database.

• In transit: mandatory HTTPS connection across the entire site.
• Encrypted backups, with a maximum retention of 89 days.

4. Access and sessions

• The session travels in a cookie protected against being read from scripts and used from other sites.
• Failed login attempts are counted and temporarily lock the account.
• Changing the password closes the other sessions.
• Financore panel administrators sign in with two-step verification.

5. Who on the team can see your data

• We do not have access to your password.
• Support only enters an account to reproduce a failure that you report, in read-only mode and for a limited time: the session expires after 30 minutes.

6. Providers

We only use necessary providers (hosting, payments, messaging, AI) and we ask them to protect the information. Their list is in the Privacy Policy.

7. Logs

We keep records of who did what, for security and traceability, for up to 24 months.

8. Backups and recovery

We make encrypted backups every day and store them outside the application. We keep full backups from the last 35 days and, for up to 89 days, one per month. What is deleted may remain in backups until they rotate. We do not promise a recovery time until we measure it.

9. Security testing

We review the code with internal tools and with an automated security review on every change, and we have carried out full internal audits. We do not have a third-party audit or penetration test.

10. What we do not claim

• We have SOC 2 coverage through our technology provider, whose white label we are. We do not claim other certifications or third-party audits.
• We do not use the phrase “bank-level security” or promise that there will never be incidents. No system is infallible.
• We do not promise an uptime percentage.

11. If there were a breach

If unauthorized access to personal data is detected, we notify the affected firms without undue delay and within the deadlines of each state's law. The notice will say what information was affected, what we did, and what the firm should do with its clients.

12. What we ask of you

• A unique, strong password; do not share it.
• Give access only to your team and remove it when someone leaves.
• Send the client's SSN only through the secure link, not by chat or email.
• Notify us if you suspect improper access.

13. How to report a security issue

Write to [email protected] before disclosing it. We respond, work on the fix, and do not take legal action against anyone who reports in good faith and without accessing third-party data.