Security at Fincore

Data Protection

All customer data is encrypted in transit using TLS 1.3 and at rest using AES-256. Financial information and integration credentials are stored in managed, encrypted database services with strict access controls, and secrets are held in a dedicated key-management vault.

AI & Data Use

Fincore does not use your data to train, fine-tune, or build evaluation datasets for any model - ours or our LLM providers'. LLM providers are engaged under enterprise terms contractually configured for zero data retention, meaning your data is not stored on the provider side after a request is processed and is never available for training.

Your data is processed solely to deliver the finance workflows you have engaged us for. There is no secondary use - no cross-tenant sharing, no analytics product, and no “agent improvement” use of any kind.

Tenant Isolation

Each customer organization's data is held in dedicated, logically isolated data stores - never co-mingled with another customer's records and never shared across storage structures. This structural isolation is reinforced at every layer: application-layer authorization on every query, tenant-scoped access at the service boundary, and per-tenant identifiers on every record. Every operation against your information is bounded to your tenant and inaccessible to any other Fincore customer.

Access Control

We follow the principle of least privilege. Access to systems and customer data is limited to a small set of authorized personnel on a need-to-know basis, granted based on role, and reviewed periodically.

Workforce access is gated through MFA-enforced single sign-on with role-based access controls, and every access event is captured in per-identity audit logs. Administrative access to production requires connection through our corporate VPN and additional controls.

Application Security

We maintain secure software development practices, including code review, dependency vulnerability monitoring and remediation, and a CI/CD pipeline with controls on changes reaching production.

Security Testing

Fincore engages an independent third-party firm for annual penetration testing of the platform, with the most recent report available to customers under NDA. Findings are triaged by severity and remediated through our vulnerability management process.

Infrastructure Security

Our infrastructure runs on Microsoft Azure with network-layer protections including segmented network environments, per-tier network security groups with default-deny baselines, and isolation between our production and non-production environments. Administrative access to production systems is restricted and gated through a bastion host.

ERP Integrations & Agent Audit Trail

We built our own ERP integration layer rather than routing through a third-party ETL or data vendor, so your data and credentials never traverse an additional sub-processor. OAuth tokens are vault-stored, rotated, and scoped to your ERP's native permissions.

Every agentic write-back is logged with the originating user, the tools and inputs the agent invoked, the resulting change in your system, and a timestamp - giving you a complete, attributable record of what was done and why.

Compliance

Fincore's security controls are designed and documented against the AICPA Trust Services Criteria covering security and confidentiality. Fincore has completed a SOC 2 examination of those controls, and the full report is available under NDA to customers engaging with us under contractual terms. We are committed to maintaining and continually improving our security posture as we grow.

Data Retention

Customer data is retained only for as long as needed to deliver the Service. On offboarding, all customer data is deleted from production systems within 30 days, subject to any legal retention obligations.

Confidentiality

These commitments are reinforced contractually through the confidentiality obligations in our customer agreements and enforced technically through need-to-know access controls with per-identity audit logging.

Contact

For security questions or to report a concern, contact us at security@fincore.ai.