Compliance
Product Security
Secure access
Access to Imburse is via an encrypted invitation link to set up secure credentials. Imburse supports SSO and IP whitelisting.
Permissions
Imburse is designed to allow organizations to granularly and securely control user privileges for both account portal (configurational settings) and tenant portal (operational settings).
Uptime
We have an uptime of 99.95%.
Network and app security
Data hosting & storage
By default Imburse’s data is hosted on Azure servers located in North and West Europe. However, we understand the importance of data sovereignty and have the ability to configure alternative locations. Speak to our sales team to find out more.
Failover & DR
Continuous access control monitoring and regular audits form part of our Disaster recovery policies and procedures.
All services are over fault zones and replicated in case of failure. Our data is geo-replicated and secured in two different data centers located over 600kms from one another.
Virtual private cloud
Our backend servers are hosted in virtual private networks in Microsoft’s Azure cloud, which are implemented in a hub-and-spoke architecture. The backend servers are not directly accessible from public networks and we employ strict zero-trust networking principles in our virtual networks. There are several layers of security between our backend servers and the network edge, which includes a Web Application Firewall, a Network Intrusion Detection and Prevention System, DDOS protection, and advanced threat detection systems. All traffic is encrypted end-to-end and we have implemented network policies following a strict principle of least-privilege.
Backups
All databases have replicated instances into paired-regions and have strong regional replication to ensure there is no data loss. Transaction persistence requires strong consistency in order to be processed. This regional replication allows us to fail-over to another region in the event of a disaster.
All services are over fault zones and replicated in case of failure.
Monitoring
Imburse uses multiple internal and 3rd-party tools for monitoring its production environment and protecting it against potential threats or errors:
-
An internal notification mechanism is in place to alert Imburse operations and support teams on different anomalies detected in production.
-
Azure Cloud analytics tool is configured to continuously monitor Imburse’s production and sandbox environment status, including server availability, CPU, memory, disk space and other key metrics; the Cloud Monitoring tool also sends alerts to Imburse’s operations team based on preconfigured policies.
-
Datadog is used for continuous log monitoring and archiving
-
Datadog is used for live production monitoring
-
OpsGenie is used for incident management in our production environment.
Internal production monitoring dashboards aggregate information from Imburse’s multiple systems and provide our operations personnel a clear view of Imburse’s production environment status. Imburse also operates a support ticketing system allowing administrators and end-users to report any issues or errors they encounter while using Imburse’s web-based solution.
Permissions & authentication
All Imburse API access requires secure, token-based authentication. You can generate an access token from the API keys you create on the platform.
Encryption
All network traffic sent to Imburse is encrypted end-to-end. Our API and other interfaces are TLS/SSL only. All transaction data is encrypted at rest using top end symmetric encryption (AES-256). Additionally, customer-sensitive fields have additional AES-256 encryption on top of that, using the customer’s own key.
Penetration testing
Imburse performs continuous penetration testing and vulnerability scanning as part of our CI/CD pipeline. We use an external ethical white hacking company for penetration and vulnerability testing and have an advanced intrusion detection and prevention system in place.
24/7 incident response
We recognize that Imburse may be critical to our client’s businesses. That is why we have on-call engineers available at all times.
Imburse implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post mortem. All employees are informed of our policies.
Information security
At Imburse we understand how important information security is to all of our stakeholders.
In order to identify and manage risks we have implemented a robust, company-wide Information Security Management System (ISMS) that is fully compliant and certified to ISO27001 (the internationally recognized standard for information security management).
Financial data security
Imburse is PCI Level 1 compliant, ensuring that your financial data is secure during processing handling storage and transmission.
We also follow EU GDPR requirements to ensure that all data processed is used only for the strict purpose under which is collected.
Additional security features
Training
All employees complete continuous security, awareness, and data protection training as part of our commitment to information and data security.
Policies
Imburse has developed a comprehensive set of security policies covering a range of topics including business continuity, incident management, and disaster recovery plans. We operate on a privacy-by-design principle and regularly review and test our procedures.
Confidentiality
We take the confidentiality of our information and that of all of our stakeholders seriously. All of our employees, contractors, and subprocessors are bound by the same standards, codified in legal agreements and reflected in our processes and procedures.
Cookie Policy
We abide by EU and UK GDPR regulations and only collect information that is necessary (refer to our privacy policy for more information). Nonessential cookies and trackers are never dropped without consent.
Data Protection
Imburse follows the EU and UK GDPR requirements. We have an external Data Protection Officer (DPO) to oversee and advise on our data management using the ICO Accountability framework. Read our privacy policy to find out how we manage your data.
User data
Only information that is absolutely necessary is collected and retained for the minimal amount of time required to operate the service.
Data protection by design
Our systems and processes are designed in a privacy-by-design mindset.
Imburse’s multi-tenancy architecture allows for 100% compliant data segregation between teams, country by country, and region by region.
Data protection impact assessment (DPIA)
We regularly engage experts to perform data protection audits. Our last external review was performed in October 2022.
Data Sharing & transfer
Like most companies, we use a number of third parties as part of our data processing, for example, cloud services and technology services. We have a due diligence process with all our payment service providers and all subprocessors of personal data have a Data Processing Agreement in place. Those DPAs are scrutinized by our DPO and must be approved by the senior leadership team prior to signing. Where data is transferred outside of the EEA, we ensure that appropriate protection and mechanisms are in place, for example, the Standard Contractual Clause and associated due diligence.
Imburse will not ever sell your data to anybody!
Certifications & accreditations
Certifications and accreditations: ISO27001, PCI DSS, UK and EU GDPR assessment performed against ICO framework.
Exemptions: Finma, BaFin, Banco de Portugal