Security

Built on Amazon Web Services (AWS), one of the most secure and reliable cloud infrastructures in the world.

‍

Overview

Finpace leverages AWS's security standards to provide an enterprise-grade security environment for financial professionals.

While we await our audit results for SOC 2 Type II certification, by hosting our platform on AWS, we (and you) automatically benefit from many of the security assurances AWS provides, including compliance with SOC 2, GDPR, HIPAA, and other industry-standard frameworks.

‍

Key Security Features

1. AWS Security

Finpace is built on AWS, which means we inherit AWS's world-class security infrastructure. AWS is certified for a wide range of security frameworks, including SOC 1, SOC 2, SOC 3, ISO 27001, GDPR, HIPAA, and more. Finpace is currently in its own SOC 2 Type II audit; however, the underlying AWS infrastructure ensures that we meet high standards for data security and compliance.

AWS Security Measures Include:

• Physical Security: AWS data centers are protected by 24/7 security staff, video surveillance, and biometric access control systems.
• Encryption: Data is encrypted both in transit (using TLS) and at rest using AES-256 encryption.
• Monitoring and Auditing: AWS provides continuous monitoring and auditing tools, ensuring compliance with industry standards.
• Automatic Backup and Redundancy: AWS offers automatic data backup and redundancy to ensure data integrity and availability.

2. Data Encryption

All sensitive data stored within Finpace is encrypted using industry-standard encryption protocols. This includes:

• Data at Rest: Encrypted using AES-256, ensuring that all stored information is secure.
• Data in Transit: Protected using Transport Layer Security (TLS) to prevent unauthorized access during communication between your devices and our servers.

3. Multi-Factor Authentication (MFA)

Finpace supports Multi-Factor Authentication (MFA) to enhance security for all user accounts. This additional layer of security helps protect against unauthorized access, even if login credentials are compromised.

4. Role-Based Access Control (RBAC)

To ensure that only authorized users have access to sensitive information, Finpace implements Role-Based Access Control (RBAC). Administrators can define specific user roles (e.g., Admin, Advisor, Support) to limit access based on the user's role within the firm. This minimizes the risk of sensitive data being accessed by unauthorized personnel.

5. Secure Document Management

Finpace’s DocuVault ensures secure document storage. Documents, such as driver’s licenses, tax forms, and financial statements, are stored with encrypted protection and can be accessed only by authorized users. The platform is also built to prevent unauthorized access or tampering with these documents.

6. Secure E-Signatures

Finpace’s DocuBuilder ensures that all e-signatures are secure and legally compliant. E-signing sessions are protected with consent popups to verify signer identity, and each session can be layered with two-factor authentication (2FA) for enhanced security. Location and IP addresses are also tracked to provide additional validation of signature authenticity.

7. One-Time Passwords (OTP) for Sensitive Data

Finpace uses One-Time Passwords (OTP) for forms containing sensitive data. This added layer of protection ensures that access to confidential client information, such as financial details, is protected by time-sensitive passwords that reduce the risk of unauthorized access.

8. Audit Trails

For compliance and security transparency, Finpace provides detailed audit trails for all critical actions, including form submissions, document uploads, and e-signature sessions. These logs allow firms to track activities and maintain compliance with regulatory standards such as FINRA and SEC.

9. Secure API Integrations

Finpace integrates with third-party tools (such as CRMs and compliance software) through secure, token-based API connections. Each API integration is built with security protocols to ensure that data is transferred securely between systems, minimizing the risk of data breaches or leaks.

‍

Compliance and Certifications

While Finpace seeks an independent SOC 2 Type II certification, AWS, our cloud infrastructure provider, is certified under SOC 1, SOC 2, SOC 3, and numerous other compliance frameworks. This provides an additional layer of assurance regarding the safety and security of data hosted on our platform while we await a favorable response from our SOC 2 Type II auditor.

‍

Security Best Practices for Users

To further enhance the security of your Finpace account and operations, we recommend the following best practices:

• Enable MFA: Ensure that all users enable Multi-Factor Authentication (MFA) for added protection.
• Regularly Review Access Levels: Use Role-Based Access Control (RBAC) to regularly audit and adjust user access to sensitive data.
• Educate Your Team: Train your staff on phishing and social engineering threats to prevent unauthorized access.
• Use Strong Passwords: Encourage all users to use strong, unique passwords and regularly update them.
• Monitor Activity Logs: Regularly review activity logs and audit trails to detect any unusual or unauthorized activity.

‍

Reports

Finpace is seeking it's SOC 2 Type II certification. If you'd like a copy of our security protocols and/or our SOC report when it becomes available, please email us at help@finpace.com

‍

Find an issue?

If you suspect any security issues or find any bugs within our system, please tell us here and click on Bug Report.

‍

Conclusion

Finpace ensures the highest level of security by leveraging AWS’s advanced security infrastructure, encrypting sensitive data, and providing tools like MFA, OTP, and audit trails to protect your firm’s information.

While we await the results of our independent SOC 2 Type II certification, our use of AWS means we inherit the security measures that help you remain compliant with industry standards.