# Security

Innexo is committed to protecting customer and guest information through industry-standard practices, including TLS 1.2+ in transit, AES-256 at rest, role-based access control, and multi-factor authentication for administrative accounts.

Canonical URL: https://innexo.com/security

## At a Glance

- TLS 1.2+: in transit
- AES-256: at rest
- RBAC: access control
- MFA: admin sign-in

## Infrastructure

Innexo systems are hosted in secure cloud environments, and these controls apply to every production environment that stores customer information. They include:

- Network firewalls
- Private network segmentation
- Restricted administrative access
- Continuous monitoring

## Encryption

- In Transit: All data transmitted between clients and Innexo servers is encrypted using TLS 1.2 or higher. HTTPS is enforced across all production services.
- At Rest: Sensitive information is encrypted at rest using AES-256 or equivalent. This includes databases, storage volumes, and backups. Financial records from Plaid (account names, balances, transaction details, access tokens) are encrypted using AES-256-GCM.

## Access Controls

Entry to production systems is restricted using:

- Role-based access control (RBAC)
- Least privilege
- Unique user accounts
- Logging and monitoring

## Authentication

Administrators must use strong passwords and multi-factor authentication. Users authenticate before accessing financial features.

## Monitoring

Innexo monitors systems for the following, and alerts feed the incident response process described below:

- Unauthorized access
- Security events
- Infrastructure health

## Vulnerability Management

Vulnerabilities are addressed through:

- Regular updates
- Dependency monitoring
- Security patching
- Critical vulnerabilities are remediated promptly.

## Plaid Integration

Financial account connections are handled through Plaid. Innexo:

- Never stores bank credentials
- Uses encrypted communication (TLS 1.2+) for all Plaid API calls
- Stores all financial records (tokens, account names, balances, transactions) encrypted at rest with AES-256-GCM

## Incident Response

Security incidents are handled through defined procedures including four steps:

- 1. Detection
- 2. Containment
- 3. Investigation
- 4. Remediation

## Multi-Tenant Isolation and Audits

Multi-tenant isolation prevents one customer's records from being reached by another tenant, and regular audits and vulnerability assessments are conducted. Customers are responsible for securing their own credentials, devices, and network access.

## Report a Concern

To report a security concern or vulnerability, email security@innexo.com.

## Related pages

- How personal information is collected, used, and retained is covered in our [Privacy Policy](https://innexo.com/privacy).
- The technical and organizational measures above are also documented in our [Data Processing Addendum](https://innexo.com/data-processing-addendum).
- API integrations built on the [developer platform](https://innexo.com/developers) use the same TLS and role-based protections.
- Read [how Innexo protects guest information during integration](https://innexo.com/how-it-works), including GDPR compliance, PCI DSS, and anonymization of training records.