Security and compliance at N5

N5 builds a financial industry platform used by banks and financial institutions across the Americas. Security is a core requirement of everything we ship. This portal describes our security program, the controls we operate, and the documents available to customers and prospects under NDA.

3Compliance frameworks
36Security controls
34Documents
4Subprocessors

Compliance

ISO/IEC 27001 Certified
Certified ISMS: 10 approved policies mapped to Annex A (A.5-A.8)
Annual penetration test Recurring
Annual third-party ethical hacking, mandated by policy, plus continuous vulnerability scanning
GDPR / LGPD Recurring
Privacy program aligned to GDPR and LGPD: consent management, personal data anonymization and data subject rights support

Requesting documents

Document summaries are public. Full documents are shared under NDA: go to the Documents section, request access, and the N5 security team will review your request. NDA · Documents

Responsible disclosure

If you believe you have found a security vulnerability in an N5 product or service, please report it to security@n5now.com. We acknowledge reports within 2 business days. Please do not test against production tenants or access data that is not yours.

Report issue

Controls

Infrastructure Security

Environment and customer segregation. Production, non-production and customer workloads run in strictly segregated cloud environments under central governance
No public infrastructure exposure. Production workloads run on private infrastructure, never directly exposed to the internet
Centralized backups. Automated backups, centrally managed and governed by a formal backup policy
Infrastructure as code. Every infrastructure change is peer-reviewed and deployed through controlled, auditable pipelines under a formal change management policy
Single-tenant isolation. Each customer runs on dedicated infrastructure with separate databases, encryption keys and access controls
Hardening baselines. Systems are configured against CIS Benchmarks and NIST secure configuration guidelines

Data Security

Encryption at rest. All data stores are encrypted at rest (AES-256) with centrally managed keys
Encryption in transit. TLS 1.2+ on all traffic
Data anonymization. Formal personal data anonymization procedure
Information handling. Data classification and handling policy
Customer-managed keys. Bring-your-own-key (BYOK) supported; keys protected in FIPS 140-2 Level 3 HSMs with formal lifecycle management
Data deletion and portability. At contract end, customer data is exported in open formats and securely deleted with certification
Data residency. Customers choose the cloud region where their data is processed and stored

Application Security

Secure development lifecycle. Secure development policy with SAST and dependency scanning in CI
Vulnerability management. Formal procedure backed by continuous scanning and cloud-native threat detection
Annual penetration testing. Third-party ethical hacking every year, mandated by policy
Perimeter protection. WAF and anti-DDoS protections on public-facing services, aligned to the OWASP Top 10

Endpoint Security

Device management. Corporate device management policy
BYOD program. Managed bring-your-own-device policy
Endpoint detection and response. EDR on all workstations involved in service delivery
Endpoint data loss prevention. Removable media, unauthorized software and unapproved transfer channels are blocked on managed devices

Network Security

Centralized audit logging. Immutable audit logs across all cloud infrastructure, centrally collected and retained
Threat intelligence. Operational SIEM and threat intelligence program
Network segmentation. Environments run on segmented networks with no direct connectivity between them
24x7 security monitoring. Continuous security monitoring with severity-based alerting and incident escalation

Corporate Security

SSO and MFA. Enterprise single sign-on with mandatory multi-factor authentication for all staff
Secure remote work. Remote work policy
Vendor management. Supplier classification and due diligence policy; critical vendors must hold ISO 27001 or SOC 2
Disaster recovery. Documented DRP with periodic testing
Least privilege and segregation of duties. Role-based access under least privilege; product administration and security administration are separable roles
Security awareness training. Recurring security training for all staff; confidentiality clauses in every employment contract

Product Security

Enterprise SSO. Customer identity providers integrate via SAML 2.0 and OpenID Connect; OAuth 2.0 and mutual TLS for service-to-service integration
Multi-factor authentication. MFA can be enforced for platform users; always mandatory for administrative profiles
Role-based access control. Granular RBAC managed by the customer: role creation, permission assignment and user membership
Identity provisioning. Automated user provisioning from the customer's identity management via standard protocols
Audit logging and export. Immutable application audit trails with long-term retention, exportable to the customer's SIEM via API or SFTP

Risk Profile

Key resilience and deployment facts banks ask first. Contractual values may be tailored per engagement; supporting evidence is available under NDA in Documents.

Recovery Time Objective (RTO)

4 hours

Adjustable per contract

Recovery Point Objective (RPO)

10 hours

Adjustable per contract

Tenancy model

Single-tenant per customer

Dedicated infrastructure, databases, encryption keys and access controls

Data residency

Customer-selectable cloud region

Deployments available in the Americas and Europe

Deployment models

SaaS, private cloud or self-hosted

Consistent platform capabilities across AWS, Azure and GCP

Environments

Development, QA, Staging, Production

Strictly segregated, with anonymized data outside production

Support

24x7 with severity-based SLAs

Escalation matrix and SLA documents available under NDA

Contract-end data handling

Export in open formats + certified deletion

Secure deletion within 10 business days of contract end, with certification

AI Governance

N5 embeds AI capabilities across its platform for the financial industry. Banks audit how AI handles their data — these are the commitments that govern every AI feature we ship.

Private AI tenancy

AI features run in a dedicated tenant per customer. Customer data is never used to train third-party or shared models, and never leaves the customer's solution environment

AI providers under vendor management

Third-party AI providers are disclosed as subprocessors and subject to the same security due diligence as any critical vendor

Full AI audit trail

Prompts, data accesses and AI-driven decisions are logged in immutable audit trails

Explainable decisions

AI-assisted decisions carry user-definable reason codes and self-documenting strategies, so outcomes can be explained to auditors, regulators and end users

Human oversight and bias controls

Business users review and adjust models continuously; champion/challenger testing and role-based approvals keep model changes under human control

Adversarial ML protections

Dataset validation, anomalous model behavior monitoring and inference endpoint protection against data poisoning, model inversion and model extraction

AI in security testing scope

AI components are included in continuous security scanning and the annual third-party penetration test

Privacy-regulation alignment

AI data processing aligns to GDPR and LGPD, supported by a consent engine and personal data anonymization in the data pipeline

Documents

Summaries are public. Full documents are shared under NDA. NDA

Document packs 2

Document	Version	Access
Complete documentation pack (ZIP) All documents in this portal, in a single download.	—	Request access
ISO 27001 evidence pack (ZIP) The 10 ISMS policies, Statement of Applicability, ISMS scope and risk methodology.	—	Request access

Policies & procedures 17

Document	Version	Access
Information Security Policy Umbrella ISMS policy, aligned to ISO/IEC 27001:2022.	1.2	Request access
BYOD Policy Rules for personal devices accessing corporate resources.	1.1	Request access
Device Management Policy Corporate endpoint configuration, protection and lifecycle.	1.1	Request access
Remote Work Policy Security requirements for remote and hybrid work.	2	Request access
Vendor Management Policy Supplier classification, due diligence and security requirements for critical vendors.	1.1	Request access
Backup Policy Backup scope, frequency, retention and restore testing.	1	Request access
Secure Development Policy Secure SDLC: code review, SAST/SCA, segregation of environments.	1.1	Request access
Information Handling Policy Data classification, labeling and transfer rules.	1	Request access
Infrastructure Management Policy Governance of cloud infrastructure, hardening and capacity.	1	Request access
Infrastructure Change Management Policy Controlled change process for production infrastructure.	1	Request access
Vulnerability Management Procedure Detection, triage and remediation SLAs for vulnerabilities.	1.1	Request access
Data Anonymization Procedure Anonymization of personal data in non-production environments.	1	Request access
Key Management Policy Cryptographic key lifecycle, BYOK support and HSM-backed protection.	—	Request access
Data Retention, Disposal & Portability Policy Retention schedules, certified secure deletion at contract end and export in open formats.	—	Request access
Physical Security Policy Workplace and datacenter physical protections: access badges, biometrics, CCTV and visitor management.	—	Request access
Personnel Security Policy Confidentiality clauses, onboarding/offboarding and certified asset return on termination.	—	Request access
Hardening Standard Secure configuration baselines based on CIS Benchmarks and NIST checklists.	—	Request access

Support 5

Document	Version	Access
Support Policy Support scope, channels, business hours and severity definitions.	—	Request access
Escalation Matrix Escalation paths, contacts and timeframes by incident severity.	—	Request access
Service Level Agreement (SLA) – Public Cloud Availability commitments and response/resolution targets for the public cloud deployment.	—	Request access
Service Level Agreement (SLA) – Private Cloud Availability commitments and response/resolution targets for the private cloud deployment.	—	Request access
Service Level Agreement (SLA) – Self-Hosted Support response and resolution targets when N5 runs on the customer's own infrastructure.	—	Request access

Compliance 5

Document	Version	Access
Statement of Applicability (ISO 27001) Applicability of ISO 27001:2022 Annex A controls.	ext	Request access
ISMS Scope Definition Scope of the information security management system.	2	Request access
Risk Management Methodology How N5 identifies, scores and treats security risks.	1.1	Request access
Internal & External Audit Program Audit policy and cadence: independent internal audits plus third-party external audits.	—	Request access
Enterprise Risk Management Program Management-sponsored ERM program covering cloud and privacy risk.	—	Request access

Resilience 3

Document	Version	Access
Disaster Recovery Plan (with test evidence) Recovery strategy, RTO/RPO targets and periodic test results.	—	Request access
Incident Response Plan Detection, roles, crisis management model and customer communication for security incidents.	—	Request access
Business Continuity Plan Business continuity management with annual business impact analysis; complements the DRP.	—	Request access

Assurance 1

Document	Version	Access
Annual Penetration Test Report (latest) Executive summary and findings of the latest third-party pentest.	—	Request access

Architecture 2

Document	Version	Access
High-level Network Diagram High-level view of environments, segmentation and traffic flows.	—	Request access
Security Whitepaper Condensed overview of N5's architecture, security controls and compliance program for early due diligence.	—	Request access

AI governance 1

Document	Version	Access
Responsible AI Policy AI governance: private tenancy, no training on customer data, explainability, bias controls and adversarial ML protections.	—	Request access

Request document access

The N5 security team reviews every request. Approved documents arrive by email as time-limited download links.

Full name Work email Company

Documents requested

I accept the terms of the NDA v1.0

Subprocessors

Amazon Web Services

Primary platform hosting

United States (us-east-1) and other regions

SOC 2
ISO 27001
PCI DSS

Microsoft Azure

Specific services and demo environments

United States / Europe

SOC 2
ISO 27001
PCI DSS

Confluent Cloud

Managed Kafka (event streaming)

United States

SOC 2
ISO 27001

OpenAI

AI language processing, consumed in a private tenant; customer data is not used to train models

United States

SOC 2

FAQ

Can we integrate our identity provider?

Yes. User authentication delegates to your IdP via SAML 2.0 or OpenID Connect, with MFA enforcement and automated provisioning from your identity management.

Where does our data live?

In the cloud region you choose, on single-tenant infrastructure dedicated to your bank. Data never leaves your solution environment.

Can we export our data and logs?

Yes. Bulk import/export is supported in open formats (JSON, XML, CSV), audit logs can stream to your SIEM via API or SFTP, and reporting integrates with third-party BI platforms.

What happens to our data when the contract ends?

Full export in agreed open formats, then certified secure deletion within 10 business days.

Do you use our data to train AI models?

No. AI runs in your dedicated tenant, your data is never used to train third-party or shared models, and every AI interaction is logged. See the AI Governance section.

How do we evaluate your security before signing?

Request access in Documents: under NDA we share our ISMS policies, Statement of Applicability, DR plan with test evidence, the latest third-party pentest report and architecture diagrams.