Security at BancoOS
This page is maintained by BancoOS to answer common security and privacy questions. It describes the controls currently enabled in the BancoOS platform and the shared responsibility between BancoOS and its customers. It is not an independent certification.
Encryption
Customer data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using industry-standard symmetric encryption. Encryption keys are managed by the underlying cloud provider's key management service and rotated on a regular schedule.
Access control
- Role-based access control for every workspace, with least-privilege defaults.
- Single sign-on through SAML and OIDC on enterprise plans.
- Multi-factor authentication available for all users.
- Session controls including timeout, device review and revocation.
Audit chain
Every action on an invoice, approval, payment or master-data change is appended to a tamper-evident audit chain. Each entry is cryptographically signed and timestamped so auditors can replay the lifecycle of any document end to end.
Hosting and data residency
BancoOS runs on hardened cloud infrastructure with isolated tenant data stores. Enterprise customers can request dedicated tenancy and Vietnam data-residency arrangements during onboarding — contact us for specifics relevant to your contract.
Compliance posture
BancoOS is built to enterprise-finance standards and aligned with SOC 2 Type II controls, ISO 27001 practices and Vietnam's Personal Data Protection law (PDPA). Current attestation reports and DPA templates are available to qualified prospects and customers on request.
Vulnerability reporting
If you believe you have found a security vulnerability in BancoOS, please email security@bancoos.vn with a description and reproduction steps. We acknowledge reports within one business day and will keep you informed through remediation.