Banking-grade security. Swiss-style discretion.

Security

Defence in depth from code commit to release: signed builds, mandatory peer review, encrypted data flows by default, segregated build environments, least-privilege access to source and pipelines.

Privacy

Customer banking data never leaves your environment. The software is engineered for data minimisation, jurisdiction-aware processing and Swiss-grade discretion — by default, SpeciTec personnel have no access to your production data.

Compliance

Designed against the regulations our clients answer to — FINMA, CSSF, MAS, DFSA, BCBS — and the cross-cutting frameworks (GDPR, ISO 27001, SOC 2) that map control evidence across them.

Resilience

Reference architectures support active-active multi-region deployments. Disaster-recovery procedures, documented incident response and BCP playbooks are rehearsed on a published cadence — not a binder on a shelf.

• TLS 1.2+ enforced for every external connection by default; TLS 1.3 supported. HSTS templates ship with the reference deployment.
• AES-256-GCM at rest for every database, object store and backup, including offline media — using the keys you provide.
• Per-tenant key derivation. Customer-Managed Keys (CMK) and Bring-Your-Own-Key (BYOK) integrate with AWS KMS, Azure Key Vault or your on-prem HSM. Custody stays with you.
• Field-level encryption for designated PII and credentials, with envelope keys you control and rotate.

• SAML 2.0 SSO, OIDC and SCIM 2.0 for every user-facing surface — federated to your IdP.
• Granular RBAC mapped 1:1 to your operating model; segregation of duties enforced at the IAM layer, not by convention.
• MFA enforcement is configurable per role, with hardware-key support for privileged operators.
• SpeciTec personnel have no standing access to your production environment. Any support engagement is opt-in, time-bounded and fully audited at your IdP.

• Mandatory peer review on every change. No direct pushes to release branches.
• Static application security testing (SAST), software composition analysis (SCA) and secret scanning gate every pull request.
• Signed container images and SLSA-style provenance metadata. Build pipelines run in isolated, ephemeral runners.
• Annual independent penetration testing of the product, plus targeted re-tests on every major release.

• Reference Kubernetes manifests and Terraform modules ship with sane defaults: default-deny egress, private VPC peering, hardened container images, no SSH.
• Hardening guides cover Azure, AWS and on-premise targets; CIS-benchmarked baselines are part of the deployment kit.
• Web application firewall and DDoS guidance is provided per cloud target — your operations team owns the runtime.
• Reference architecture supports air-gapped operation when regulatory or political constraints require it.

• The platform emits a structured, immutable audit log for every privileged action — your operations team retains and rotates it.
• Security events stream to your SIEM via webhook, syslog or object-store drop. SpeciTec does not operate a shared SIEM that holds your data.
• Anomaly detection signals (auth, privilege escalation, data-egress) are surfaced for your monitoring stack to consume.
• Detailed, machine-readable telemetry contracts are published so your SOC integrates the platform alongside the rest of your estate.

• Reference architectures support active-active multi-region deployments. Engineered RTO target: 4 hours. Engineered RPO target: 15 minutes — when deployed per the reference architecture.
• Disaster-recovery runbooks ship with the product. Your operations team owns the execution; we provide drill scripts and acceptance tests.
• Documented incident response: severity tiers, customer-notification windows and post-mortem cadence apply to issues in our software, not to your runtime.
• Business continuity for SpeciTec the company (engineering, support, customer success) is rehearsed on a published cadence and audited under our ISO 27001 ISMS.