Security & Compliance

What this means for you: We run on Amazon Web Services — the same cloud that powers Netflix, NASA, and most of the big banks. So your data sits in proper, purpose-built data centres with security guards, backup generators, fire suppression, the works. Not on a server under someone's desk. AWS have spent billions on this infrastructure and we get the benefit of all of it.

What this means for you: There are two moments when data could be vulnerable — when it's moving between your computer and our servers ("in transit"), and when it's sitting on our servers ("at rest"). We encrypt it in both cases. So whether your data is travelling or stored, it's locked up tight. Even if someone intercepted it mid-transfer, they'd just see scrambled nonsense.

What this means for you: We're pretty strict about who gets in and what they can do once they're in. Everyone needs a password and a phone code — no shortcuts. And once logged in, people only see what their role allows. Your junior staff can't go deleting things, and your admin decides who sees which clients. It's layered so that no single point of failure can expose data.

Why Azure OpenAI, not ChatGPT? This is a question we get a lot. We use Microsoft's enterprise AI service, which is completely separate from the public ChatGPT that everyone uses day-to-day. The big difference? Your data never gets stored, shared, or used to train any AI models. Microsoft already have all the data privacy agreements in place — GDPR, SOC 2, HIPAA — the lot. So your financial information is covered under the same contracts that protect banks and hospitals. Once the AI generates a response, it forgets everything. Nothing is retained.

What this means for you: GDPR is the EU's data protection law — it gives you the right to see all your data, download it, or ask us to delete everything permanently. HIPAA is the US equivalent for sensitive information. We designed BankReconPro to comply with both from day one, not as an afterthought. So whether your clients are in London, New York, or anywhere else, the same strong protections apply across the board.

What this means for you: This is a quick-glance summary of everything we've covered above, mapped to the specific regulation each one satisfies. Worth noting — every item here says "Active". These aren't roadmap items or things we plan to do eventually. They're live, right now, on the platform you're already using.

What this means for you: We back everything up automatically, several times a day, and keep copies in different physical locations. If a server goes down — or even if an entire data centre has a problem — your data is safe and the system switches over within minutes. You wouldn't lose any work. The "RPO" and "RTO" columns below basically show how much data you'd lose (almost none) and how quickly things get back to normal (very quickly).

What this means for you: We want to be upfront about exactly who else is involved. These four companies are the only third parties that touch any part of your data, and here's what each one actually does: Amazon runs the infrastructure (but can't read your encrypted data). Microsoft powers the AI features (but doesn't keep anything afterwards). Stripe handles card payments (they never see your financial documents — just billing details). And Google is only involved if you choose to sign in with your Google account. All four have signed proper data processing agreements with us.