Security, stated plainly.
What Fused does to keep one institution’s data apart from another’s, to keep the ledger from changing under you, and to decide who may do what. Each statement below is something the system enforces.
Isolation
Your institution’s data is not a filtered view of a shared table.
- Its own database
- Each institution has its own PostgreSQL database, looked up for every request rather than named in configuration.
- Row-level security inside it
- Database policies stay in place as a second layer, even though the database already belongs to one institution.
- An identity check on opening
- Before any work runs, Fused proves the database it opened names the institution the request belongs to.
Integrity
The figures cannot be changed quietly, by a person or by a bug.
- Append-only ledger
- Update, delete and truncate are revoked on the journal, the receipts register and appraisals. A correction is a new, linked reversal.
- Balanced twice
- An entry whose debits and credits differ is refused by the application and again by a constraint in the database.
- Exact amounts
- Amounts are stored as exact decimals at each currency’s own scale, never as floating point, and rounding is always stated.
- No double payments
- Money movements carry an idempotency key claimed in the same transaction as the write, so a retried request cannot post twice.
- A trail that proves itself
- Every write records an event on a SHA-256 hash chain in the same transaction. Each chain’s tip is copied every minute to a separate database under a separate credential, so a rewritten chain is caught.
Access
Who can sign in, and what each person may see and do.
- Two steps at every sign-in
- A password, then a code from an authenticator app. Codes are never sent by SMS.
- Passwords handled properly
- Hashed with Argon2id and checked against known breached passwords. Repeated failures lock the account.
- Office-scoped roles
- A role reads the whole institution, its holder’s own branch, or that branch and those below it.
- Maker-checker
- Approval flows decide who may approve, how many must, and by when. The person who raised an item cannot approve it.
- Reviews and a trail
- Access-review campaigns record a decision on who holds what, and the sign-in trail has a reader for your auditors.
Hosting
Where Fused runs, and how the infrastructure is kept honest.
- Hosted on AWS
- Managed PostgreSQL, serverless compute and a content delivery network, all on Amazon Web Services.
- Infrastructure as code
- Every resource is created by Terraform from version control. Nothing is configured by hand.
- No stored cloud keys
- Deployments authenticate with short-lived credentials, and secrets such as SMS gateway passwords are encrypted.
Privacy
Personal data is kept for as long as it is needed, and no longer.
- Erasure that keeps the trail
- A former staff member can be erased without the audit trail forgetting what was done.
- Retention
- Ended sessions, spent sign-in challenges and settled messages are pruned on a schedule.
Engineering
How changes reach you.
- Four levels of tests
- Unit, API contract, end-to-end and load tests, with a 96% coverage floor.
- Additive database changes
- Every migration adds and never removes, so the previous release keeps running while a new one rolls out.
What we do not claim
Fused does not hold a security certification today, and this page does not imply one. It does not take card payments, which keeps it out of card-industry scope by design.
If your board or regulator needs a written security overview, ask for it when you book a walkthrough and we will go through it with you.
Ask for the security overviewSee it on your own products and numbers.
A walkthrough with the team that builds Fused: your loan products, your branches, your month-end.