Security controls that match the money.
NEO Collect moves client funds, so the platform is built and operated to the standards a bank would expect of its own systems.
Encryption
TLS 1.2 or higher for every connection. AES-256 at rest for databases, backups and object storage. Keys are managed in a hardware-backed key management service and rotated annually.
Authentication
Console access requires single sign-on or a password plus mandatory two-factor authentication. API access uses scoped, rotatable secret keys or OAuth 2.0 client credentials.
Access control
Role-based access in the console with separate roles for viewers, operators, approvers and administrators. Four-eyes approval is enforced for payouts above configurable thresholds.
Audit logs
Every console action and API request is logged with actor, timestamp, IP and request ID. Logs are immutable and retained for seven years.
Infrastructure
Production runs in ISO 27001 and SOC 2 certified data centres in the European Union, across multiple availability zones, with encrypted backups replicated to Canada.
Testing
Independent penetration testing at least annually and after any material change. Automated dependency and container scanning on every build.
Webhook integrity
All webhook deliveries are signed with HMAC-SHA256 over a timestamp and the body. Replay protection rejects signatures older than five minutes.
Business continuity
Documented incident response and business continuity plans, tested annually. Recovery point objective of 15 minutes and recovery time objective of 4 hours for core services.
Found something? Tell us.
We welcome reports from security researchers. Please report vulnerabilities to security@neofin.tech and give us a reasonable time to fix them before disclosure.
What we ask
- Do not access, modify or delete data that is not your own.
- Do not run denial-of-service tests or automated scanners against production.
- Use the sandbox environment wherever possible.
- Include enough detail to reproduce the issue.
What we commit to
- Acknowledgement within 2 business days.
- A status update within 10 business days.
- No legal action against good-faith research that follows these rules.
Need our security documentation?
Our compliance pack includes the security overview, penetration test summary and certifications.