Exact decimals
Amounts are stored and calculated as exact decimals, never as floating-point numbers.
BankIA / Security
Security and trustDesigned to handle money, with security stated plainly.
This page describes what the platform does today to protect money and data, and also what is still missing. We do not claim certifications we do not have.
- Money in exact decimals
- Isolation per instance
- Deployment with rollback
- Two-step verification
Accounts are not done with approximations
Server-side calculations
Fees, currency exchange and limits are calculated by the server; the browser cannot alter them.
Ledger
Every transaction is recorded with its date and origin. Corrections are made with new transactions.
Dual control
Sensitive console operations require approval from another person.
Who gets in and how
Hashed passwords
Passwords are not stored in plain text. They are compared against a hash and can be checked against public breaches without exposing them.
Two-step verification
Available to clients and administrators with temporary-code authenticator apps.
Roles and permissions
Each user sees and does only what their role allows.
Sessions and devices
Sign-in history, email alerts and remote session sign-out.
Each client in their own space
Isolation
Each institution has its own instance with its own domain and database. Within NatIA Ahorro, each savings circle (natillera) is isolated from the others.
No card data
For subscriptions, only the brand and the last four digits are stored.
Secure invitations
Invitation links expire, are single-use and are stored hashed.
Backup before changing
A backup is made before changes are applied to the database.
Defenses in the code
Forgery protection
Every form submission carries a token that prevents another site from triggering it.
Strict headers
Content security policy with nonces and blocking of unauthorized scripts.
Parameterized queries
Database queries use parameters to prevent SQL injection.
Audit
Administrative actions are recorded with who, what and when.
Every change is tested before it ships
Automated tests
A suite of more than a thousand tests runs in a staging environment before release.
Deployment with rollback
Every deployment is verified and, if it fails, rolls back to the previous version.
Encrypted traffic
All platforms are served over HTTPS.
Health check
Periodic checks that each platform responds and its scheduled tasks run.
What we will do before handling real money
The current version is a demo. Before handling real money or personal data, we will complete this plan.
- 1
Security analysis
Vulnerability scanning of the code and the infrastructure, with fixes for what is found.
- 2
Two-step verification obligatoria
For all administrators of each instance.
- 3
Independent review
An audit or penetration test by a third party.
- 4
Legal review
Privacy notice, contracts and data processing reviewed by lawyers.
- 5
Backups and recovery
Periodic backup restoration tests.
Honesty about the current state
- We have no certifications. We do not currently hold ISO 27001, SOC 2 or PCI DSS.
- There is no independent audit yet. It is in the plan before use with real money.
- The current version is a demo. It must not be used to store money or sensitive real data.
- BankIA is not a financial institution. There is no deposit protection.
Need the technical details for your risk team?
Write to us and we will share the available documentation.