Trust and security
How the platform protects identities, access and data, how changes to money and rules are governed, how it is operated, and where we stand on certification. Each statement here describes behaviour that ships today, including what is not there yet.
Identity and sessions
Strong customer authentication
A second factor at sign-in, every payment confirmed by a code bound to its amount and payee, passkeys, lockout after repeated failures and a five-minute idle timeout.
Staff second factor and security keys
Password sign-in needs an e-mailed code; approver roles can be held to a FIDO2 hardware key. Argon2id hashing for passwords, and a password policy.
Revocable, device-bound sessions
Signed tokens carry a key id and are checked against a rotating key set, backed by server-side sessions bound to the device. Revocation is immediate.
Access and tenancy
Tenant inside the authorisation decision
Every role check is scoped to your company and branch, not only to the user, and the build fails on a database query that forgets the scope.
Every decision logged
Each allow and deny is recorded with portal, path, role, tenant and employee.
Modules you have not rented stay off
Twenty-three services check the workplace's rental on every request and log each refusal.
Data protection
Field-level encryption
Client profiles, identity scans and card numbers are sealed under separate keys, with blind indexes that keep them searchable.
GDPR operations
A consent register, data requests with statutory deadlines and extensions, erasure judged against retention and legal holds, and exports, each approved by a second person.
Encrypted transport and secrets
Internal services require mutual TLS with per-service certificates; the ledger path accepts only listed callers; configuration and database connections are TLS with authentication.
Malware-scanned uploads
Files uploaded to documents, verification, e-banking and loan applications pass a malware scanner before they are stored.
Governance and audit
Four-eyes approval
Payments, ledger corrections, the month close, flows, rule sets, policies, templates, AML parameters, loan payouts and write-offs cannot be approved by the person who submitted them.
A sealed audit trail
Signed events from every service, chained per workplace, sealed every 15 minutes, verified hourly and kept for five years with legal holds. The seal key is kept off the host.
A ledger that closes
Period gate, month close and year end, a trial balance from the ledger, integrity checks and a drift freeze lifted only by an approved request.
Replayable operations
Every workflow step is audited, can be dry-run without writing and restarted from the failed step.
Operations
Observable by default
Health and readiness endpoints, metrics and distributed traces on every service, with alerts that reach people by e-mail.
Tested on every change
Formatting, static checks, a security lint and the whole test suite run against real databases before anything ships.
Backups with a tested restore
The ledger and the system of record are backed up nightly; a restore drill of the core passed on 22 October 2026.
What is not yet there
The platform runs on a single host region without automatic failover; a second node and replicated stores are on the roadmap, and we say so in every pilot.
Certification
Steinvar does not hold a security certification today. The controls above are built so an audit can verify them; this page will change when a certification is awarded.