Security for one bank at a time.
keoTM is designed so that a bank's loan data stays in that bank's own deployment and every person sees only the part of it that their role needs.
One bank per deployment
Each bank runs its own deployment with its own database. keoTM has no tenant column to get wrong and no shared tables that hold another bank's loans.
Data stays in the bank's deployment
With the self-hosted option the data never leaves your infrastructure. With the hosted option gycs runs a dedicated database for your bank, kept apart from every other bank.
Single sign-on
Staff sign in through the bank's identity provider with OIDC or SAML, or with a password. A device that keoTM does not recognize must confirm a code sent to the person's email, and session lengths are set in the bank's configuration.
Access follows the roster
The staff roster decides who may use keoTM, in which role and in which branch. Identity provider claims never grant access on their own, and a deactivated person is refused on the very next request.
Scoped access by role
A Branch Manager sees only their own branch, a Collection Executive only the work assigned to them and a Collection Head the whole bank. The server works out the scope from the session and the roster on every request, and the screens never send a branch or staff id as proof.
Append-only audit log
Sensitive actions are recorded in an audit log, and the database role the application runs as may only read and add to it, so entries cannot be changed or deleted through keoTM.
This page describes how the product is built and does not list certifications or audits. Ask for the details your security team needs when you book a demo.
See keoTM on your daily loan feed.
Tell us about your bank and we will arrange a walkthrough with demo data.