Security and deployment
A licence covers lending; it does not replace control over an IT vendor. This is how AMIO keeps your institution in control.
Your infrastructure
Each institution gets its own instance with its own domain, API, servers and database, in your data centre or a cloud region you choose. It is installed with Terraform and Helm, with a documented process for upgrades, backups and exit.
Your keys and data
Encryption keys stay in your key management service, and customer data never leaves the instance. Your customer identifiers are stored only as keyed tokens.
No vendor access by default
AMIO staff have no access to production data. Emergency access works only for a scope and a time your institution approves, and every action is logged where your institution can see it.
Only anonymous telemetry
The instance sends AMIO licence checks and aggregate counts, never personal data. Your institution can switch sections off.
Sign-in and roles
Staff sign in through your identity provider. Your institution manages roles and permissions, and every change is in the audit log.
For your vendor review
Architecture and data flows, an ISO 27001-aligned control set, outsourcing and exit documentation and penetration test reports are available under NDA.
Who is responsible for what
- Institution
- Identity checks, credit bureau, credit decision, terms and APR, the agreement, financing, repayment and credit complaints.
- Merchant
- The seller: product, price, delivery, invoice, returns and sales complaints.
- AMIO
- White-label apps, catalog, integrations, merchant tools and technical support.
- Institution environment
- Apps, API, database and data in your infrastructure; access rights, maintenance and third-party control by contract.
- Communication
- Your institution's identity and credit terms are always shown clearly, even under a separate brand.
The legal and technical split of obligations is set by the contract, not by how the app looks.
Talk to our team.
We share the security documentation with your vendor management and information security teams.