Read-only access. Encrypted data. No transaction capability.
Cashvyne is built around the principle that a treasury intelligence platform has no reason to initiate transactions. Our bank connections are read-only by design. Your cash cannot be moved through Cashvyne — period.
Security by design, not security as an afterthought
Read-Only Bank Access
All bank connections are provisioned at the reporting/inquiry permission level. Cashvyne cannot initiate payments, approve wires, access credit products, or modify account settings. This is enforced at the bank permission layer, not just software logic.
TLS 1.3 in Transit
All data moving between Cashvyne and bank APIs, SFTP servers, ERP systems, and user browsers uses TLS 1.3 with Perfect Forward Secrecy. Older TLS versions are not accepted at any endpoint.
AES-256 at Rest
All stored data — balance snapshots, transaction records, forecasting models, user data — is encrypted at rest using AES-256. Encryption keys are managed in a dedicated KMS isolated from application databases.
No Password Storage
Cashvyne uses OAuth tokens for bank connections that support it, and SSH key pairs for SFTP connections. We never store online banking usernames or passwords. Tokens are encrypted at rest and rotated per bank policy.
Customer Data Isolation
Each customer's data is logically isolated at the database level using customer-scoped keys and row-level security. No cross-customer data access is possible through any application path. Your data is never used to train models for other customers.
SOC 2 Type II Controls
Cashvyne is designed with SOC 2 Type II controls across security, availability, and confidentiality trust service criteria. Formal audit process initiated. Detailed controls documentation available to enterprise customers under NDA.
Controls summary for IT and security reviews
Security documentation available upon request.
IT and information security teams can request our full security controls summary and SOC 2 readiness documentation under NDA.
Request Documentation