Security your information-security team can review.
Lending data is some of the most sensitive information a bank holds. Amanova is built so that your own security team can inspect, test and run it, on their infrastructure if they choose.
Decisions you can trace
Every change recorded
Each document keeps its version history: who changed what, and when. Workflow steps and comments stay with the application.
AI held to account
Every AI result is stored with its inputs, the model or engine that produced it and the person who accepted or rejected it.
Separation of duties
Officers capture, underwriters assess and managers approve. Compliance gates block an approval until KYC, screening and limits are met.
Access and isolation
Each lender in its own database
On our service every lender has a separate database, so one lender's data is never stored alongside another's.
Least privilege
Customers see only their own applications and loans; each staff role sees only what its work needs.
Sign-in protection
Two-factor sign-in for staff, password strength rules, lockout after repeated failures and sessions that can be revoked.
Private documents
Identity documents, statements and photos are private files, served only to signed-in users allowed to see them.
Secrets encrypted
API keys and passwords for bureaus, ID services and AI providers are stored encrypted with a key held only in the server configuration.
Fraud signals
Edited statements, shared devices, reused documents and mismatched income are flagged before a decision.
Hardened when you install it
- The application runs as a non-root user in containers built from published sources.
- The database and caches sit on an internal network with no route in from outside.
- HTTPS with TLS 1.2 and 1.3 only, with automatic certificates or your own.
- Backups with checksums, and a restore command that verifies them first.
- Signed subscription file checked offline: nothing needs to call home.
Data residency and regulation
Amanova is designed so you can meet the rules that apply to you. Your compliance function decides how; here is how the product helps.
| Requirement | How Amanova helps |
|---|---|
| State Bank of Pakistan outsourcing and cloud rules | Run it on your own servers or an approved cloud in Pakistan; backups and exit stay under your control. |
| SAMA cloud and outsourcing rules (Saudi Arabia) | Install on your own servers or an in-Kingdom cloud; AI can be limited to on-premises models. |
| CBUAE outsourcing rules and the UAE PDPL | Deployment on infrastructure you choose, with consent records and data kept where you decide. |
| Bangladesh Bank digital-lending storage rules | Run the Bangladesh entity in Bangladesh, separate from other countries. |
| Nigeria Data Protection Act, Kenya Data Protection Act | Consent captured and stored for every check; customers' data stays in the deployment you choose. |
| Fair lending and explainability | Every decision shows the factors that helped and held it back, and declined customers get reasons they can act on. |
We are not a law firm, and this table is not legal advice. Amanova has not yet been through an independent security certification; we are glad to support your own assessment or penetration test. Report a vulnerability to security@amanova.app.
See it with your own products.
Open the live demo now, or book a walkthrough and we will set it up with your products, limits and brand.