Skip to content
Fyxop

Trust is earned, one measure at a time

Our software handles banking data. Here is what is actually in place, how we work and what we do not claim.

Measures in place

9 measures in place, in production today

Each measure is linked to the platform that carries it. We only list what runs in production today; work in progress appears here only once committed, with its deadline.

Data

  • Data segregated per client

    On FIDIS, each institution has its own database schema. On Riskless, each user belongs to a single institution.

    FIDIS and Riskless

  • Sensitive data encrypted

    Sensitive fields are encrypted in the database.

    FIDIS

Access

  • Bounded sessions

    15-minute access token, sign-out after 60 minutes of inactivity, sessions capped at 12 hours.

    FIDIS

  • Role-based access and segregation of duties

    Each person only sees what their role allows. The author of a control is not its approver.

    FIDIS

Traceability

  • Readable audit log

    Every action is recorded in plain language, can be filtered and exported to PDF by the institution's administrator.

    FIDIS

  • Automated tests

    More than 850 automated tests cover the platform.

    FIDIS

Infrastructure

  • Hardened infrastructure

    Docker containers behind a firewall, database accounts without unnecessary privileges, backups.

    FIDIS

Artificial intelligence

  • Segregated AI

    Our assistants only work on the data of the institution using them, never on another client's.

    FIDIS and Riskless

This website

  • A site without tracking

    No cookies and no audience measurement. The site loads nothing from another server, enforces a content security policy and filters abuse of the contact form.

    fyxop.com

Our method

  • Security in the specifications

    Data segregation, access rights and traceability are defined during scoping, not added afterwards.

  • Acceptance testing before production

    Each increment is tested on a staging environment and approved before it goes into production.

  • Audits of our own platforms

    We audit our software as we audit our clients': defects, access rights, code quality, with a dated action plan.

  • Documented measures

    FIDIS measures are documented against Annex A of the ISO/IEC 27001 standard.

What we do not claim

A relationship of trust starts with clear limits.

  • We are not ISO/IEC 27001 certified

    We document our measures against the standard. Certification is a process specific to each organisation.

  • Our software does not replace your obligations

    It helps organise, measure and document. Compliance remains each institution's responsibility; a report to the CENTIF, for example, is still filed by the institution.

  • AI does not decide

    It prepares and suggests. Your teams review, correct and sign.

Documents on request

As part of a project or an assessment by your security, compliance or audit teams, we provide:

  • the security file for the solution concerned, including how the AI works;
  • the coverage of measures against Annex A of ISO/IEC 27001;
  • the hosting and deployment arrangements chosen.
Request the documents

Report a vulnerability

Think you have found a flaw in one of our websites or software products? Please write to us.

  1. 1Email us with “Security” in the subject line.
  2. 2Describe the issue, the address concerned and how to reproduce it.
  3. 3Do not access other people's data and do not make anything public before it is fixed.

Email contact@fyxop.com

Who is behind our software

Full legal notice
Company
FYXOP SARL, SARL (limited liability company) under Senegalese law
Registered office
Patte d'Oie Builders, Villa No. D18 bis, Dakar, Senegal
Trade register (RCCM)
SN.DKR.2024.B.35348
Tax ID (NINEA)
011486562

A security question about a project?

Do your security or audit teams want to know more before committing? Write to us.

Contact

Or email us at contact@fyxop.com