Secure Database for User Records

In fintech, safeguarding sensitive customer data, including Personally Identifiable Information (PII) collected during Know Your Customer (KYC) processes, is a critical priority. KYC is essential for verifying customer identities, preventing fraud, and ensuring compliance with anti-money laundering (AML) regulations. However, securely managing and storing this data poses significant challenges due to its sensitive nature and strict compliance requirements.

Databunker, an open-source vault for securely storing sensitive data, provides a robust solution for meeting compliance standards such as GDPR, SOC2, HIPAA, and ISO 27001 while simplifying the management of KYC information. Databunker is available in two versions: an open-source edition for developers and startups, and Databunker Pro, designed for business organizations, which can be deployed both in the cloud and on-premises.

This guide references the open-source version of Databunker, with the final section covering the features and benefits of Databunker Pro for larger business needs.

This post outlines 8 steps fintech companies can take to strengthen data security, ensure compliance, and build user trust with Databunker.

Step 1: Secure PII/KYC Data Storage and Encryption

Databunker acts as a fortified encrypted vault, enabling fintech startups to securely store sensitive customer data, including PII and financial records. By implementing robust encryption measures, Databunker ensures that data is shielded from unauthorized access and potential data breaches.

All records stored inside Databunker are encrypted.

Here is a sample API request to save a user record:

curl -H 'X-Bunker-Token: XXXXXXX' \
     -H 'Content-Type: application/json' \
     -X POST 'https://databunker.company.com/v1/user' \
     --data '{"firstname":"John","lastname":"Doe","email":"user@email.com","login":"john"}'

Here is a sample API request to save user application data:

curl -H 'X-Bunker-Token: XXXXXXX' \
     -H 'Content-Type: application/json' \
     -X POST 'https://databunker.company.com/v1/userapp/email/user@email.com/shipping' \
     --data '{"address": "Red square 1","city": "Moscow","country": "Russia"}'

Step 2: Pseudonymization for Enhanced Anonymity

Pseudonymization is a term found in GDPR articles. It means storing user details separately from your regular database, creating a pseudonymized identity to reference the original user records. When saving a user record in Databunker, it generates a user token (in UUID format), which you can store in your regular database.

Check out this diagram illustrating this process:

Step 3: User Rights Management

Databunker offers an optional, user-friendly interface that allows customers to access and review their personal data. Admins can choose to enable or disable this feature. When enabled, fintech startups can facilitate data modifications and updates requested by users, ensuring compliance with GDPR’s provisions on individual rights, including the right to access and the right to rectification.

Step 4: Forget-Me Operation

Databunker’s forget-me operation empowers users to request the permanent deletion of their personal data. By promptly fulfilling these requests, fintech startups can uphold GDPR’s right to erasure, enhancing customer trust and demonstrating their commitment to data privacy.

Step 5: Comprehensive Audit Trails and Logging

Databunker automatically generates audit trails and logging features, allowing fintech startups to track and monitor data access and activities. These comprehensive logs enable organizations to maintain compliance with regulations such as SOC2 and provide valuable insights in the event of security incidents.

Step 6: Data Encryption in Transit

To safeguard customer secrets during data transmission, Databunker extends encryption measures to data exchanged between systems. Encrypting data in transit bolsters data integrity and confidentiality, addressing requirements set forth by SOC2 and other relevant frameworks.

Step 7: Privacy by Design Principles

Databunker is designed with privacy by design principles, ensuring that privacy considerations are integrated into the fintech startup’s data handling processes from the outset. This adherence to privacy by design aligns with GDPR’s requirements and strengthens data protection efforts.

Step 8: Use Advanced Security Features

Databunker Pro extends the capabilities of the open-source version with additional features:

• Enterprise security: multi-tenancy, key rotation, and Shamir’s secret sharing
• Format-preserving tokenization API, scalable to billions of tokens
• Available for cloud, on-premises, or embedded deployments
• Enterprise-grade installation experience
• Professional support

Conclusion:

In today’s fast-evolving fintech landscape, ensuring the protection of customer secrets is a fundamental responsibility for startups. By following these 8 steps and leveraging the power of Databunker, fintech companies can fortify their data security practices, adhere to industry regulations, and build lasting trust with their customers. Safeguarding customer secrets not only strengthens the company’s reputation but also sets the stage for sustainable growth and success in the competitive fintech market.