Authentication & authorisation

We enforce strict role-based access control and multi-factor authentication to safeguard our APIs and management functions, ensuring maximum data security.

Risk assessment

We regularly assess data, systems, and infrastructure risks to stay updated on potential threats and effectively execute mitigation strategies.

Penetration tests

Our systems undergo periodic testing by certified third party security testing services.

Vulnerability scans

We carry out regular vulnerability scans to proactively identify and preempt any threats to the integrity of its systems.

Training

All Neem employees with access to systems are required to undergo annual training on security procedures in place and best practices.

Privacy

We follow rigorous procedures covering storage and handling of data, to comply with applicable financial and privacy laws.

Audit logs

We collect audit trails for all system level events of its infrastructure.

Data encryption

We use TLS 1.3 and AES 256 encryption to protect data during transit and at rest, ensuring both data integrity and confidentiality.

Segmentation

Our production, sandbox and QA environments are fully segregated with different access control lists.

Network

We maintain strict filters for traffic via security group rules, for both inbound and internal traffic.

API-key and OAuth 2 token scopes

Access for client systems is scoped by their tokens which ensures that each client can access only the subset of resources designated for them.

JWT token based access for customers

Separate JWT based authentication for end users coupled with multi-factor authentication which ensures a specific user has access only to their allowed data and features.

Token expiration

All tokens are short-lived, limiting the possibility of compromise.

SSL and EV certificates

We use TLS 1.3 and 1.2 certificates and EV certificates to better assure its identity to clients.

Roles & permissions

Role-based access controls limit user access to a specific subset of data based on their assigned role when logging into applications.

Sensitive data masking

All personally identifiable or any other sensitive data is masked whenever displayed or stored in audit trails.

Redundancy

Our platform is designed for high availability, minimizing failover and recovery times.

Backups

All production data is regularly backed up and stored within the same jurisdiction.

Monitoring

Continuous infrastructure monitoring promptly alerts any failures, minimising recovery times.

Business continuity

A tested business continuity plan with separate disaster recovery infrastructure is in place to address disruptions.