Infrastructure a financial institution can trust.
Security in core banking is not a badge on a website. Below are the control areas we build and document against — and a straight account of what we will and will not claim until it is verifiable.
What we build and document against.
These are the areas your risk, compliance and technology teams will ask about. Detail on each is documented as it becomes production-ready and can be evidenced.
DATA
Data isolation
Keeping each institution’s customers, accounts and financial records separated from every other institution on the platform.
Encryption
Protecting institution data in transit between systems and at rest in the platform’s storage.
Data residency
Where an institution’s data is stored and processed, and what that means for its regulatory obligations.
ACCESS
Access controls
Which people and systems can reach which data, enforced through roles and permissions inside the core.
Maker-checker
Requiring a second authorised user to approve sensitive operational and financial actions before they take effect.
Audit logs
A record of what was done, by whom and when, so activity in the core can be reconstructed after the fact.
CONTINUITY
Backups
How institution data is backed up, how often, and how a restore is verified rather than assumed.
Disaster recovery
The plan for restoring service and data if the primary environment becomes unavailable.
Monitoring
Watching the platform’s behaviour so problems are detected by us rather than reported by your customers.
Business continuity
How an institution continues to operate — and how we continue to support it — through a disruption.
Three things we hold ourselves to.
Institutions are asked to trust a core with their customers’ money. The least we can do is be precise about what is true today.
We publish controls, not adjectives
A control appears here with detail once it is implemented and can be evidenced during your own due diligence.
We do not claim certifications we do not hold
No compliance certifications, regulatory approvals or audit standards are claimed on this site unless they have been formally obtained.
We do not publish uptime commitments here
Availability commitments belong in a contract with an institution, not in marketing copy. Ask us and we will tell you exactly where we stand.
Running due diligence on OREBAN? Send your security questionnaire through and we will answer it directly rather than pointing you at a page.
Bring us your due diligence questions.
We would rather answer a hard question honestly than publish a claim we cannot evidence.