Skip to content

Security & privacy

Financial institutions trust us with their most sensitive asset: customer data. We hold that responsibility to the same standard your regulators hold you to, with independent certifications across every framework that matters in financial services.

security & privacy

Compliance

We hold independent, third-party certifications and attestations across the frameworks that matter most to your institution and regulators:

051a1de0efb8390e5b166701c274fe18430f5759
PCI DSS Compliant

The Payment Card Industry Data Security Standard (PCI DSS) is the global standard, maintained by the major card networks, for organizations that store, process, or transmit payment card data. It mandates strict controls around encryption, access, network security, and monitoring.

aicpasoc
SOC 2 Type II Compliant

SOC 2 is an independent attestation, performed by a licensed third-party auditor, that evaluates how an organization protects customer data against the AICPA's Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

aicpasoc
SOC 3 Compliant

SOC 3 is a public-facing report derived from the SOC 2 examination, summarising the same Trust Services Criteria without the confidential detail of the full report.

gdpr
GDPR Compliant

The EU General Data Protection Regulation (GDPR) sets the standard for how personal data of individuals in the EU and EEA is collected, processed, stored, and protected — including individuals' rights over their own data and strict rules for the organizations that handle it.

033cbcdda0e4831a733cc71f14f4700527a30a312
ISO 27001 Certified

ISO/IEC 27001 is the leading international standard for information security management. Certification means an accredited body has audited our Information Security Management System (ISMS) — our governance, risk assessment, and the controls we use to keep information secure — and confirmed it meets the standard.

security & privacy

Access control

We implement layered identity and access management controls to ensure users are granted only the access required for their role. Access is governed by the principles of least privilege, need-to-know, periodic access reviews, and monitoring controls designed to protect sensitive information.

Audit log

Access to detailed information about user activity-related events to identify potential security issues, review access, and troubleshoot configuration changes.

Role-based access

Control what each role and user can see and do, down to the level of individual features, data objects, and customer metrics.

Data masking

Hide sensitive data from roles that do not require them, while remaining available to the processes that do.

Principle of least privilege

Access is granted based on job function, business requirements, and a need to know basis.

security & privacy

Security practices

We apply a defense-in-depth security approach across our people, processes, and technology. Security controls are integrated into the software development lifecycle and supported by established policies, access controls, continuous monitoring, vulnerability management, security testing, and compliance programs to protect customer data and platform services.

Data security

Customer data is protected through encryption in transit and at rest, backup procedures, retention controls, and recovery processes designed to support confidentiality, integrity, and availability.

Application security

Threat modeling and secure design reviews are integrated into NGDATA's software development lifecycle. Software releases undergo code review, security scanning, vulnerability assessments, and regular penetration testing aligned with industry best practices.

Corporate security

All NGDATA employees complete mandatory security awareness training and acknowledge company security policies and standards. Access to internal systems is protected through multi-factor authentication and role-based access controls.

Network security

NGDATA implements layered network security controls including network segmentation, intrusion detection and prevention capabilities, traffic monitoring, filtering controls, and denial-of-service protection to help protect against unauthorized access and suspicious activity.

Endpoint security

Employee devices are centrally managed, encrypted at disk level, and run endpoint detection and response software that reports to NGDATA's security team.

Infrastructure security

The platform runs on a redundant, logically segmented cloud environment that isolates customer environments from one another and keeps production separate from development and test. It's backed by secure configuration standards, patch and change management, and regular independent security assessments and penetration testing.

security & privacy

Incident & vulnerability management

We maintain processes for vulnerability management, security monitoring, and incident response to identify, assess, and address security events in a timely manner.

See it running on data like yours