Your borrowers' data, protected like a bank would.
How we secure the platform, where your data lives, and how our AI stays explainable and fair.
Infrastructure
Hosted on Microsoft Azure with network isolation, web application firewall, DDoS protection and infrastructure defined as code.
Tenant isolation
Every client runs on a dedicated database with its own encryption keys. No client can ever see another's data.
Encryption
TLS 1.2+ in transit and AES-256 at rest, with keys managed in Azure Key Vault.
Access control
Single sign-on, multi-factor authentication, role-based permissions and maker-checker on every critical action.
Secure development
Code review, automated security scanning and independent penetration testing before major releases.
Resilience
Automated backups, disaster recovery across availability zones, and 24×7 monitoring with incident response.
Data residency by region
Your data is hosted in the Azure region your regulator requires. Where an in-country region is not available, we agree the location with you and your regulator before go-live.
| Region | Hosting | Data protection framework |
|---|---|---|
| United Arab Emirates | Azure UAE regions | UAE PDPL; sector rules where applicable |
| Saudi Arabia | In-kingdom hosting | KSA PDPL |
| European Union & UK | Azure EU / UK regions | GDPR · UK GDPR |
| United States | Azure US regions | GLBA · state privacy laws |
| Africa & Asia | Nearest compliant Azure region | Local data-protection law |
Certifications & attestations
Responsible AI
- Every score comes with the main reasons behind it
- Models tested for bias before release and monitored after
- Humans approve policy changes and can override any decision
- Client data is never used to train models for other clients
Security documents for your review
Available to banks and financial institutions under NDA.
- Security whitepaper and architecture overview
- Latest penetration test summary
- Completed security questionnaire (SIG Lite / CAIQ)
- Data Processing Addendum and sub-processor list
- Business continuity and disaster recovery summary
Found a security issue?
Report it responsibly to security@bstech.world. We respond within 2 business days.