Compliance and secure development

This page describes the standards and attestations HES FinTech maintains as a vendor, how the platform helps an institution meet its own regulatory obligations, and the secure software development lifecycle behind HES LoanBox releases.

Standards and attestations

The platform supports the operations a data controller needs — data-subject access, correction, and erasure; data minimization; and records of processing — and is configured to the privacy regime of the institution’s market. Across the regions HES LoanBox serves, that includes:

In every case the institution is the data controller and remains responsible for compliance; HES LoanBox provides configurable controls for these requirements and keeps records that auditors can review. It does not assume the institution’s obligation on its own.

Regulatory alignment

HES LoanBox is configured to the requirements of the institution’s jurisdiction and lending products. The platform provides controls that help automate regulatory workflows and mitigate operational risk, and it keeps auditable records for the examination cycle. It does not make the institution compliant on its own — the compliance of lending decisions and operations remains the institution’s responsibility.

NIST alignment

HES FinTech’s security program is aligned with the NIST Cybersecurity Framework (CSF), which it uses as a reference for identifying, protecting against, detecting, responding to, and recovering from cyber risk. This is a framework alignment, not a certification.

Secure software development lifecycle

Security is built into how HES LoanBox is developed, not added at release. The platform is built on a Java LTS stack, and security practices run across the lifecycle.