Security
Finio holds real money and real ledgers. Security isn't a pillar on the marketing page — it's the ground floor. Here's the detail your FD will ask for.
Compliance
Fully compliant. UK DPA 2018 aligned. DPA available on request.
Type II in progress with Vanta. Type I attest available now.
Aligned. Certification underway.
Certified integration, reviewed annually.
Data security
TLS 1.3 for every request. AES-256 at rest with per-tenant keys.
Google, Microsoft, Okta SAML. MFA enforced on all admin accounts.
Six role tiers out of the box. Custom roles on Estate. Least-privilege by default.
Every keystroke, approval and posting recorded. Exportable to your SIEM.
Restrict access by IP range or country. On Estate and Enterprise plans.
Xero connection uses read/write only where required. Revocable in one click.
Permissions
Six roles preconfigured — GM, FC, FD, AP clerk, accountant, view-only. Custom roles for anything else. Every action scoped by entity.
Infrastructure
Primary region. AWS eu-west-2.
Warm secondary. Automated failover under 5 minutes.
Cold backup, encrypted, retained 30 days.
Your data never leaves the UK/EU. No US sub-processors.
Security review
DPA, sub-processor list, pen-test report — sent to your FD in one email.