Enterprise-Grade Security That Protects Your Financial Data
Your financial data is protected by enterprise-grade security infrastructure and internationally recognised certifications. Our approach ensures the confidentiality, integrity, and availability of your treasury data at all times.
Trusted by leading financial teams
ISO/IEC 27001:2022 Certification
Our ISO/IEC 27001:2022 certification confirms that we meet the highest international standards for information security management.
Our Information Security Management System encompasses annual risk assessments, structured incident response procedures enabling rapid detection and recovery, and tested business continuity plans. Every employee, contractor, and third-party user operates within these standardised controls.
SOC 2 Type II Attestation
Our SOC 2 Type II report, issued by an independent auditor, confirms that Embat's security controls are not only designed correctly but operate effectively over time. Unlike a point-in-time assessment, Type II evaluates how those controls performed throughout the audit period.
General Data Protection Regulation (GDPR)
We are firmly committed to the principles and requirements set forth by the General Data Protection Regulation (GDPR). Your personal data receives protection through encryption, pseudonymisation, and strict access controls. Data is classified by sensitivity level with corresponding handling procedures.
We maintain complete audit trails, enabling you to demonstrate regulatory compliance. Upon request or at contract termination, your data is securely deleted within defined timeframes.
Digital Operational Resilience Act (DORA)
Our operational resilience framework meets DORA requirements for ICT risk management, threat-led penetration testing, and third-party oversight.
We maintain business continuity plans with defined RTO/RPO targets, conduct annual penetration testing, and implement continuous monitoring of ICT systems. Formal security assessments ensure critical third-party dependencies align with DORA obligations.
EU AI Act
Our company operates within the framework of the EU AI Act, the world's first comprehensive AI regulation.
We strictly adhere to its risk categories: we avoid any systems classified as unacceptable risk, ensure our high-risk solutions meet all necessary legal and technical requirements, and maintain high transparency standards across all our other applications. In doing so, we guarantee that our technology is not only innovative but also ethical and fully aligned with current regulations.
Bank connectivity
SOC 2 Type II across our connectivity partners
Direct connections to banking partners operate under SOC 2 Type II standards, independently audited for security, availability, processing integrity, confidentiality, and privacy.
All connectivity providers maintain their own SOC 2 Type II attestations through regular third-party audits, complementing Embat's own report.
PSD2 Compliance Framework
Your connectivity supports AISP and PISP protocols under PSD2, with strong customer authentication per EBA guidelines. Certificate-based authentication with banks means credentials are never stored; secure protocols establish trusted connections directly with financial institutions
AISP - PISP - EBA
ERP Connectivity
Certified ERP Connectors
We have direct partnerships with providers such as Microsoft and SAP, along with certified connectors and official marketplace listings that ensure end-to-end encryption and audit logging. These integrations simplify connectivity between your ERP systems and Embat, enabling secure and seamless data exchange across your financial operations.
Public API
Our public API uses password-based JWT authentication with time-limited tokens, ensuring secure and controlled access. It also implements role-based access control with least privilege, TLS 1.2+ for data in transit, and segregated environments with independent access controls.
Payments
Your payments process meets strict banking payment directives. We work exclusively with licensed payment institutions, ensuring all transactions comply with applicable regulations. Payment processing is segregated from other platform functions to maintain security boundaries and operational isolation.
Your organisation controls payment execution through configurable multi-level approval workflows. Different payment types (Accounts Payable, Treasury, International, Local) operate under specific security controls aligned with regulatory requirements. All payments must be signed within those approval processes using one-time passwords (OTPs), in accordance with banking regulations. Payment signatures follow European directives through role-based approval mechanisms, with all activities logged and encrypted.
Platform and network
Role-based access control (RBAC)
Access to your platform operates through role-based access control (RBAC) that assigns permissions based on job functions and responsibilities. Each user receives a unique, non-transferable account during onboarding, ensuring traceability of all monitored actions.
Platform Audit
We validate our platform security through annual third-party penetration tests and comprehensive vulnerability assessments. Internally, we conduct quarterly security audits and vulnerability scans to ensure continuous improvement. All controls and monitoring systems operate in real time, including intrusion detection, continuous security monitoring, and automated threat detection.
Multi-factor authentication (MFA)
Multi-factor authentication (MFA) is available for all user accounts and can be enforced at the organizational level. Embat also supports Single Sign-On (SSO) with multiple identity providers. Session duration and automatic logout settings can be configured to enhance account security and compliance.
Single Sign-On (SSO) with SAML
Enjoy secure, one-click access to Embat. Using SAML SSO, we’ve made it easier than ever to manage team permissions while strengthening your security posture. Works out of the box with any corporate identity provider.
Network on Google Cloud Platform
Your data resides on Google Cloud Platform with segregated network architecture. Production, staging, and development environments are completely isolated, with access controlled through Identity and Access Management (IAM) based on the principle of least privilege and custom role definitions.
AI Security
Human in the Loop
TellMe provides insights whilst you retain complete operational control. Our artificial intelligence system generates suggestions and analyses that require your approval before any operational action takes place. No autonomous transactions or decisions execute without human authorisation, ensuring you maintain oversight of all treasury operations.
Guardrails and business rules validation
Our AI interactions operate within strict boundaries through sophisticated guardrails and business rule validation. The system prevents generation of inaccurate or misleading information by continuously validating recommendations against actual financial data and enforcing compliance rules. Guardrails eliminate hallucinations by forcing the agent to pass through business rule validation.
Database Sharding
Your data remains isolated through database sharding architecture, with each customer's information stored in separate database partitions that prevent cross-contamination. Anonymisation techniques protect sensitive information during AI processing, enabling intelligent analysis whilst maintaining privacy standards. Customer data is never mixed between organisations and never used for training models without explicit consent
Confidentiality
and compliance
Your information receives multi-layered protection through structured data governance and comprehensive safeguards. Data is classified into sensitivity levels with corresponding handling procedures. Encryption standards apply consistently: AES-256 for stored data and TLS 1.2+ for transmission across all communications.
For a comprehensive view of our security practices, see our Information Security Policy.
Get started now