Finpage moves real money for regulated lenders. Security is not a feature we added; it is the constraint the platform was designed under: data residency in India, encryption everywhere, dual control on anything irreversible, and an audit trail that outlives the loan.
Production runs in AWS Mumbai with multi-AZ redundancy, private networking and no data leaving Indian jurisdiction.
TLS 1.2+ on every connection; AES-256 at rest for databases, backups and object storage, with managed key rotation.
Aadhaar numbers tokenised in an isolated vault; PII masked in logs, UI and non-production environments.
Least-privilege roles scoped to branch and function, MFA on privileged accounts, session controls and access reviews.
Dual control on vouchers, masters, treasury deals, adjustments and configuration changes. Nothing irreversible by one person.
Every transaction, override and login logged with actor, time and before/after values, retained to the RBI horizon.
Code review, dependency scanning, secrets management and CI security gates; periodic VAPT on every release line.
Full-stack monitoring watches application, infrastructure and jobs, with severity-routed on-call and incident post-mortems.
Encrypted point-in-time backups, cross-AZ replicas and tested recovery procedures with defined RPO/RTO.
Certification names, scopes, certifying bodies and validity dates to be confirmed by Twinline before publishing.
Information security management · scope and certificate no. to be added
Periodic vulnerability assessment and penetration testing · assessor and cadence to be added
Type and period to be confirmed, or remove if not applicable
Inherits AWS compliance programmes for physical and infrastructure controls
If you believe you have found a security vulnerability in Finpage or finpage.in, please report it to info@twinline.in with enough detail to reproduce it. We acknowledge reports within two business days, keep you informed, and do not pursue good-faith researchers who respect user data and avoid service disruption. A machine-readable policy is published at /.well-known/security.txt.
Architecture diagrams, policies, VAPT summaries and questionnaire responses for your IT and risk teams, under NDA.
Request the security pack →