Built for finance teams that get audited

BancoOs processes the documents that move your company's money, so the platform is built around three properties: tenant isolation that the database enforces, an audit trail that no one — including us — can silently rewrite, and humans in the loop for every financial action.

• Every tenant table carries the organization key and PostgreSQL Row-Level Security (with FORCE) is the enforcement layer — application filters are defense-in-depth, not the control. The app's database role cannot bypass RLS, and production refuses to boot if it could.
• External integrations run behind circuit breakers with bounded, jittered retries and explicit timeouts; failures degrade to recorded exception states instead of crashes.
• Uploads are antivirus-scanned (ClamAV) and content-type restricted; production requires scanning to be on, or an explicit operator acknowledgement.
• Customer administrators get a live Security Dashboard in-app: sessions, MFA adoption, API-key usage, security events, backup-verification status, and export history.

The deeper write-up lives on the Security page; our operational runbooks are summarized in the repository's security documentation pack, available to enterprise prospects under NDA.

Our Privacy Policy covers what we collect and why. The operational highlights: we act as processor for workspace content, controller only for sign-in account data; we set exactly one essential cookie; consent to versioned policies is recorded per user with the exact version accepted; and both full data export and organization deletion (30-day cancellable grace window, then complete erasure) are customer self-service.

• Application & database: managed cloud hosting (see the Subprocessor List for providers and regions). PostgreSQL is the single source of truth; Redis backs queues, rate limiting, and caches; background work runs in isolated workers.
• Segregation: interactive traffic and heavy background sweeps run on separate queues so one tenant's batch load cannot starve another's uploads.
• Per-tenant quotas bound how much load any single organization can place on shared extraction infrastructure.
• Configuration is code-reviewed: retention windows, security gates, and thresholds are environment configuration, never hardcoded, and production preflight checks refuse insecure combinations.

• In transit: TLS on all external endpoints (browser, API, integrations).
• At rest: stored documents are sealed with AES-256-GCM envelope encryption — each file gets its own data key, wrapped by a master key held outside the database. Managed-database volume encryption applies underneath.
• Secrets: session-signing keys support zero-downtime rotation with a documented runbook; API keys are stored only as SHA-256 hashes and shown once at creation.
• Cloud KMS-held master keys (Azure Key Vault) are wired in the design and on the roadmap; today's default is an app-held master key.

• SSO-only: sign-in is Microsoft Entra ID (Azure AD). BancoOs stores no passwords. MFA is enforced by your identity provider, and an organization can additionally require that every BancoOs session carry an MFA claim.
• Sessions: short-lived (1 hour), httpOnly cookies, individually revocable by the user or an admin; full login history with device labels is visible in-app.
• Roles: owner / admin / approver / member with server-side checks read from the database on every privileged call. Separation-of-duties guardrails: no self-role-edit, the last owner can't be demoted, vendor bank-detail changes require a second approver.
• API keys: admin-issued, hashed at rest, expiring, revocable, and attributed to the creating user so audit trails stay personal.

Every consequential action lands in an append-only audit log that is hash-chained per organization — each entry commits to the previous one, so edits and deletions are detectable. A database trigger rejects updates and deletes outright, and signed snapshots of each chain tip are shipped to a write-once (WORM) object store, making even operator-level rewrites evident. Auditors get a one-call export package per invoice: documents, matching, approvals with actors, payments, disputes, and the verified audit trail.

Security events (logins, session revocations, key issuance, consent, exports, deletion requests) use the same tamper-evident log under a dedicated security.* namespace and are visible to org admins in-app.

AI does the reading; your team keeps the authority. Documents are extracted to structured data by a vision LLM, matching suggestions are scored, and the copilot explains decisions with evidence. Autonomy is off by default and bounded per-tenant when enabled (confidence floors, amount ceilings). Full detail — which providers see what data, and what they may do with it — is in the AI Transparency Policy. Per-tenant AI processing statistics are shown on the in-app Security Dashboard.

Current hosting regions are listed per provider in the Subprocessor List. For Vietnamese customers, cross-border transfer obligations under Law 91/2025/QH15 (transfer impact assessments, MPS filings where triggered) are actively tracked with counsel; status and dates are maintained in our PDPL compliance tracker and available to enterprise prospects. In-country hosting options are on the roadmap as provider coverage in Vietnam matures. [Residency commitments TO CONFIRM per contract.]

• Database backups use the managed provider's point-in-time recovery (continuous WAL archiving + daily snapshots).
• A scheduled backup-verification job probes what we can actually observe — database health, WAL-archiver recency where exposed, document-storage round-trip, queue availability — and publishes pass/fail to every tenant's Security Dashboard. Restore drills follow the documented Backup & DR runbook.
• Data exports and uploaded documents live in object storage with provider-side durability; audit-chain anchors live in a separate write-once bucket.

We maintain an incident-response runbook covering triage, severity classification, containment, tenant notification, and post-incident review, plus ready-to-send customer notification templates. Suspected incidents are worked from structured security logs and the tamper-evident audit trail. Customers are notified of incidents affecting their data without undue delay, with PDPL statutory windows tracked by counsel. Report anything suspicious via the Responsible Disclosure Policy.

The platform degrades gracefully by design: circuit breakers isolate flaky upstreams (banks, tax portal, ERP, AI providers), failed documents self-heal through bounded retry sweeps, and ERP pushes are idempotency-keyed so retries can never double-post an invoice. Health metrics (queue depth, stuck documents, breaker states) are exported to monitoring. Formal uptime SLAs are agreed in enterprise order forms; a public status page is on the roadmap.

• Vietnam PDPL (Law 91/2025 + Decree 356/2025): in active legal engagement — tracker, engineering controls (consent records, retention, export/erasure) shipped; counsel confirmation of filings in progress.
• ISO/IEC 27001 + ISO 22301: readiness program underway; see the published roadmap summary. Certification targeted after the control-operating period. Current readiness assessment is available to enterprise prospects.
• SOC 2: considered after ISO 27001, driven by customer demand.
• E-invoice compliance (Decree 70/2025, Circular 78): built into the product itself — GDT validation, seller verification, VAT arithmetic checks.

security@bancoos.com [TO CONFIRM] — monitored by the engineering leadership team. Vulnerability reports: see Responsible Disclosure. Enterprise security questionnaires: we maintain a pre-filled vendor security questionnaire; request it through your account contact.