Security & Trust
Where FinHub runs, how data is encrypted and scoped, and what we do and do not hold, written for BFSI procurement, risk and information-security teams.
Controls
What's Built Into Every Layer
Six control families, each one checked against the infrastructure and code that runs FinHub.
Encryption
Traffic to FinHub's API gateway is HTTPS only, with TLS 1.2 or higher. Files stored in Amazon S3 are encrypted at rest with AES-256 server-side encryption, and DynamoDB tables are encrypted at rest by AWS.
Access control
Every request is scoped to your company from its verified token, never from what a client sends. Signed-out tokens are revoked, repeated failed sign-ins lock the account, and API keys are issued per company from the customer portal.
Aadhaar handling
Video KYC shows reviewers a masked Aadhaar number. Aadhaar Masking covers Aadhaar numbers and QR codes in documents before you store or share them.
Logs you can export
API calls are logged per company with their result, time and credits, and download from the portal. ConsentGuard keeps a hash-chained log of consent events, exportable as CSV or PDF. Video KYC records each decision against the reviewer.
Infrastructure as code
Test, staging and production each run in their own AWS VPC, cluster and load balancer in the Mumbai region, defined in CloudFormation and changed through reviewed pipelines rather than by hand.
Monitoring
Production runs under CloudWatch dashboards and alarms, and every API's upstream source is health-checked on a schedule, so a failing government or bureau source shows up before your customers notice.
Certifications & Standards
Honest About Where We Stand
We describe our posture precisely: what we hold, what we document, and what stays with your institution.
No certificate we do not hold
FinHub does not hold an ISO 27001 or SOC 2 certificate today. We would rather say so than print a badge, and we share our controls documentation for your vendor-risk review.
Documentation for your review
Architecture, data-flow and control descriptions for procurement, information-security and outsourcing reviews, with the answers your RBI IT and outsourcing questionnaires ask for.
Built for regulated lenders
Data stays in India, access is scoped per company, Aadhaar is masked, and the records an inspection asks for already exist. Your own policies and controls complete the picture.
We never claim a certification we do not hold. Ask us for current status and supporting documentation during your procurement or vendor-risk review.
Data Residency in India
FinHub’s services run on AWS in the Mumbai region (ap-south-1), so verification results, consent records and logs are stored in India, which is what RBI’s outsourcing and KYC directions and most lenders’ own policies expect. Video KYC goes further and admits applicants only from Indian IP addresses. For consent itself, our ConsentGuard runs the consent and rights workflow. New to the law? Start with our DPDP compliance guide.
Encryption, Specifically
In transit, the API gateway accepts HTTPS only, with TLS 1.2 or higher (AWS load-balancer policy TLS13-1-2-2021-06). At rest, files in Amazon S3 are encrypted with AES-256 server-side encryption, and DynamoDB tables carry AWS’s default encryption. Video KYC shows reviewers only a masked Aadhaar number, and Aadhaar Masking covers Aadhaar numbers in documents before they are stored.
Responsible Disclosure
Security researchers make platforms like ours safer, and we welcome their work. If you believe you’ve found a vulnerability in FinHub, email info@habilelabs.io with reproduction steps and impact. We acknowledge reports promptly, keep you informed through triage and remediation, and will not pursue action against good-faith research that respects user data and avoids disrupting the service.
Who runs FinHub
Built and operated by HabileLabs
HabileLabs is an AWS Advanced Tier Services Partner, with the AWS AI Services and SMB Services Competencies. The badges below are HabileLabs’, not certifications of FinHub.
FAQ
Security Questions, Answered
The questions BFSI procurement, risk and infosec teams ask us most often.
On AWS in the Mumbai region (ap-south-1). Video KYC applicants must also connect from an Indian IP address.
Keep exploring
Related Resources
Need a security review?
Ask for our security documentation and controls summary for your procurement and vendor-risk review.