Security at FinVeil

AES-256-GCM field-level encryption, with a random IV per value, for designated personal information: user email addresses and names, employer company details, employee references, payroll amounts, MFA secrets, notification recipients and SMS phone numbers. Each ciphertext carries its own authentication tag. Not every column is encrypted yet (for example, sub-merchant bank account details on Connect accounts are not), and a single application key is used.

Signed JWT access tokens (60 minutes) and refresh tokens (7 days). Passwords are hashed with BCrypt. Optional multi-factor authentication (TOTP or SMS). Tenant isolation is enforced in the application layer: tenant-scoped queries are filtered by the tenant's ID, and automated integration tests attempt cross-tenant access. PostgreSQL row-level security is not enabled. Role-based access control covers roles including ADMIN, HR_MANAGER, MANAGER, AUDITOR and VIEWER.

Per-client-IP rate limiting and input validation. API keys (fvk_test_ / fvk_live_) are stored only as SHA-256 hashes and shown once. Outbound webhook payloads are signed with HMAC-SHA256 so recipients can verify them, and inbound Paystack webhooks are verified with HMAC-SHA512. FinVeil has not yet undergone an independent penetration test.

Key actions (such as registration, payments, API key and user management) are recorded with user ID, action, entity, timestamp and IP address, written in a separate database transaction. The audit log is a standard database table: it is not yet hash-chained or write-once, and not every read is logged.

The application, API and PostgreSQL database are hosted on Railway in its US West region (United States). Traffic is served over TLS. See Railway's compliance documentation for infrastructure certifications. FinVeil itself holds no security certification (such as SOC 2, ISO 27001 or PCI DSS). Card data is entered on payment providers' hosted checkouts; FinVeil does not store card numbers.

Designed with POPIA in mind; our compliance programme is under legal review. Consent is recorded per employee. Access, correction and deletion requests are handled via privacy@finveil.money. For full details, see our POPIA Compliance page.