Account security = data security

This article describes where Finmap stores data, how it is protected in transit and at rest, who can access it, and the results of the security audit.

Data location

Data is stored on servers in several data centers within the EU. Distributed hosting keeps the service running if one data center fails. Provider names are not disclosed for security reasons.

The data centers are ISO 27001 certified — an information security management system with regular external audits. [to confirm]

Network architecture

• Only public services — the web app and the API — run in the demilitarized zone (DMZ).
• The database sits in a private network segment with no direct internet access.
• Database connections are allowed only from a fixed list of backend IP addresses.
• Frontend and backend are deployed separately; access between them is restricted by keys and network policies.

Encryption

• All connections between client and server, and between data centers, are protected with TLS [version — to confirm].
• The server presents the full certificate chain (leaf and intermediate certificates), so trust is verified correctly in all modern browsers and mobile apps.
• Data in the database and in backups is encrypted at rest [to confirm: algorithm, e.g. AES-256].

Authentication and passwords

• Passwords are stored only as salted hashes ([Argon2 / bcrypt — to confirm]). A password cannot be recovered from its hash; the hash is used only to verify sign-in.
• After sign-in, a session token with a limited lifetime is issued [to confirm lifetime].
• Sign-in attempts are rate-limited to block password guessing (brute force).

In Settings → Security, users can also:

• enable two-factor authentication (2FA) — a code by email, Google Authenticator, or both at once;
• review active sessions (device, location, last activity) and end a single session or all sessions except the current one;
• enable account deletion confirmation — an account is not deleted without a code sent to the company owner’s email.

Access to company data

• Each company’s data is isolated from other companies.
• Only users invited by the owner can access a company, and only within the permissions granted.
• Developers work with a test database containing fictitious data and have no access to the production database. Changes to production data are possible only through controlled backend interfaces.

API protection

• Every request to the public API is authenticated with an API key and its input is validated.
• Per-company limits across all endpoints: 10 requests per 5 seconds, 120 per minute, 10,000 per day. When a limit is exceeded, the server returns HTTP 429 with a Retry-After header.

What data is required

Finmap does not require official details: full company name, registration number, founders, email addresses, or details of counterparties and employees. Only financial transactions are needed for accounting; company and counterparty names can be arbitrary (for example, “Designer Alina”). The service does not keep personal data databases of your clients or contractors.

Security audit

An independent security audit was carried out by Sigma Software. The overall protection rating is Medium: core security controls are in place and working; the findings concern optimization.

Severity	Found	Fixed
Critical	0	—
High	0	—
Medium	6	2
Low	10	5

Recommendations for users

Data protection also depends on your account settings. To minimize risks:

• enable two-factor authentication;
• use a unique password that you don’t use for other services;
• regularly check your active sessions and end any you don’t recognize;
• give company users only the access rights they need for their work;
• don’t share your API key with third parties, and replace it if you suspect a leak.

If you notice suspicious activity in your account or have questions about data security, contact our support chat and we’ll help you look into it.