security

 

Best practices to follow

We have always placed your security first on MONITARY. To ensure maximum security, we have made a simple list of security to-do's you can follow:

 

• never divulge your personal or business account details like password, PIN, and OTP in any medium, including calls, texts, or emails.

• we will never, ever ask you for any of the sensitive details mentioned above.

• we will never call you and ask to do any payment transaction on the app or install any remote access software such as teamviewer, anydesk, etc.

• never respond to such emails, texts, or phone calls.

• our customer support can only be reached via the app or through the customer care phone number provided on the website/app. please do not engage with any other phone numbers that claim to be of our support team.

 

Privacy Practices

We do not sell your personal information to or share it with unaffiliated third parties for their own advertising or marketing purposes.

Check out our Privacy Policy for more information.

​

Cloud Infrastructure

MONITARY is hosted on our own Virtual Private Cloud Service which provides a secure and scalable technology platform to ensure we can provide you services securely and reliably.

​

Perimeter Security

We have deployed Defense in Depth Architecture using a network firewall, web application firewall, DDoS protection layer, and a content delivery network.

Our infrastructure is launched in compliance with the MONITARY’s well Architected Framework and from the security perspective incorporating practices from our Cloud Adoption Framework

We have a 3-Tier Architecture which incorporates best practices from various standards and certifications

We have strict network segmentation and isolation of environments and services in place.

​

Host Security

We use industry leading solutions around anti-virus, anti-malware, intrusion prevention systems, intrusion detection systems, file integrity monitoring, application control, application and audit log aggregation, and automated patching

​

Data Security

We employ separation of environments and segregation of duties and have strict role-based access control on a documented, authorized, need-to-use basis

We use key management services to limit access to data except the data team

Stored data is protected by encryption at rest and sensitive data by application level encryption

We use data replication for data resiliency, snapshotting for data durability and backup/restore testing for data reliability.

​

Incident and Change Management

We have deployed mature processes around Change Management which enables us to release thoroughly tested features for you both reliably and securely enabling you to enjoy the MONITARY experience with maximum assurance

We have a very aggressive stance on Incident Management on both Systems downtime and Security and have a Network Operations Center and an Information Security Management System in place which quickly reacts, remediates or escalates any Incidents arising out of planned or unplanned changes.

​

Vulnerability Assessment and Penetration Testing

We have an inhouse network security team which uses industry leading products to conduct manual and automated VA/PT activities

We employ both static application security testing and dynamic application security testing which is incorporated into our continuous integration / continuous deployment pipeline

We also leverage CERT-IN certified auditors to do periodic external security testing and audits.

​

Standards and Certifications

We are a Federal Incorporation which means we have implemented applicable industry standard security controls governed by the Canadian council that helps us protect all our customer’s card data in a highly secure manner.

We are a FINTRAC certified corporation and have implemented required Information Systems Management System policies and procedures in order to maintain industry standard best practices and applicable controls.

All compliance/audit statuses will be updated in this section in this policy.

​

Responsible Disclosure

We at MONITARY are committed about our customer's data and privacy

We blend security at multiple steps within our products with state of the art technology to ensure our systems maintain strong security measures

The overall data and privacy security design allows us defend our systems ranging from low hanging issue up to sophisticated attacks

If you are a security enthusiast or a researcher and you have found a possible security vulnerability on MONITARY products, we encourage you to report the issue to us responsibly

You could submit a bug report to us at security@monitary.ca with detailed steps required to reproduce the vulnerability

We shall put best of our efforts to investigate and fix the legitimate issues in a reasonable time frame, meanwhile, requesting you not to publicly disclose it.