Security and compliance
Security built for banking procurement.
Banks and companies trust us with payment data. This page summarises how we protect it, and what documentation your risk and procurement teams can request.
Request security documentation- Data at restAES-256
- Data in transitTLS 1.2 and 1.3
- Employee accessMFA everywhere
- Penetration testingAnnual, third party
- Incident notificationWithin 48 hours
Defence in depth
Controls across the whole lifecycle, from the first line of code to production.
Secure development
- Static code analysis on every commit, covering the OWASP Top 10
- Four-eyes review for critical changes and production releases
- Strict separation of development, staging and production
- Real customer data never used in test environments
Encryption and keys
- TLS 1.2 or 1.3 with strong cipher suites for all public traffic
- AES-256 encryption for databases and file storage
- Salted password hashing
- API keys and secrets held in a dedicated key management service
Vulnerability management
- Automated infrastructure and dependency scanning at least quarterly
- Critical patches applied within 72 hours, high severity within 14 days
- Annual penetration test by an independent third party
Access control
- Multi-factor authentication for all internal systems and cloud consoles
- Least-privilege access, revoked immediately when a role ends
- Comprehensive, securely retained audit logs
Infrastructure
- Hosted on Google Cloud, certified ISO 27001, SOC 2 Type II and PCI DSS
- No physical servers in our offices
- Data hosted in European data centres
Data protection under GDPR
Wenalyze as data processor
We process personal data on behalf of our clients, under a data processing agreement signed with each one.
Minimal data
We process only what the service needs: identity, transaction and merchant details, partial card numbers and connection metadata.
Incident response
Confirmed incidents affecting personal data are notified without undue delay and always within 48 hours.
Audit rights
We share third-party audit reports and penetration test summaries, and support an annual audit where these are not enough.
Deletion or return
When a contract ends, personal data is deleted or returned, at the client's choice, unless the law requires us to keep it.
Documentation for your review
Our team can share the following documents under NDA, and help your teams complete security and vendor questionnaires.
- Data processing agreement
- Technical and organisational security measures
- Penetration test summary
- Cloud provider certifications and audit reports
- Answers to your security questionnaire