Security

Security is built into every Fininvo product (ERP, HRMS, Payroll, Jobs, Recruit) and our mobile apps. We operate layered controls covering data protection, infrastructure, application security, access, personnel and monitoring, backed by a documented incident response process and a public responsible disclosure programme. This page summarises the programme; the contractual commitments are in the Data Processing Agreement (Annex II). Enterprise customers may request our detailed security packet, penetration test summaries and questionnaire responses under NDA from security@fininvo.com.

The platform runs on ISO 27001 and SOC 2 certified cloud providers (Amazon Web Services and Microsoft Azure), with primary data residency in India and additional regions as configured. Physical data centre security is inherited from those providers.

• Segmented networks with security groups and firewalls; databases are never directly exposed to the public internet.
• Managed database services with automated patching windows.
• DDoS mitigation and edge protections provided by the cloud platform.
• Infrastructure managed as code, with changes reviewed and traceable.
• Environment separation between production, staging and development; production data is not used in development.

• Mandatory code review before merge; security-relevant changes receive focused review (authentication, payments, file upload, multi-tenancy).
• Automated dependency scanning and secret scanning in CI; builds fail on known critical vulnerabilities.
• Input validation, output encoding and parameterised queries via a typed ORM to prevent injection.
• Standard protections: CSRF defences, content security policy, rate limiting, brute-force lockouts and session hardening.
• Web, API and mobile apps follow the same review gates; mobile permissions are centralised and audited.

We identify vulnerabilities through automated scanning, dependency monitoring, code review, penetration testing and our responsible disclosure programme. Remediation targets by severity:

Independent penetration tests are performed at least annually and after material architectural change. Executive summaries are available to enterprise customers under NDA.

• For customers: role-based access control with least-privilege defaults, multi-factor authentication, single sign-on options, session controls and audit logs of administrative actions.
• Internally: production access is restricted to a small set of authorised engineers, granted per need, protected by MFA, logged and reviewed quarterly.
• Unique named accounts only; shared credentials are prohibited.
• Access is revoked as part of a documented offboarding checklist on the day of exit.

• Background verification for employees where permitted by local law.
• Written confidentiality obligations that survive employment.
• Security and privacy training at onboarding and at least annually thereafter.
• Role-based data handling rules; access to customer data for support requires customer-initiated context and is logged.

We monitor the platform continuously with centralised logging, error tracking and alerting on anomalous behaviour. Our documented incident response process covers detection, triage, severity classification, containment, eradication, recovery and post-incident review with corrective actions.

• Automated daily encrypted backups; restore procedures tested periodically.
• Deployment across multiple availability zones for resilience to data centre failure.
• Documented disaster recovery plan with defined recovery targets: recovery point objective (RPO) of 24 hours and recovery time objective (RTO) of 8 hours for the production platform.
• Continuity planning covers loss of a region, loss of key personnel and third-party provider failure.

Card payments are processed by PCI DSS Level 1 certified gateways (Razorpay in India, Stripe elsewhere). Card numbers and CVV codes are captured directly by the gateway and are never stored on Fininvo systems. Recurring payments in India follow the RBI e-mandate framework with pre-debit notification.

If you believe you have found a security vulnerability, please report it privately under our Responsible Disclosure programme or via /.well-known/security.txt. We acknowledge reports within 3 business days and offer safe harbour for good-faith research.