Legal

Security

Last updated: November 2026

Our approach

Banks and merchants trust us with sensitive work, so security is built into how the platform is designed, deployed and run.

Your data, your network

The bank fraud system runs inside the bank's own network. Customer records and investigations stay there, and Rifbid does not use the bank's customer data.

Encryption

Data sent to and from Rifbid is encrypted in transit using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256, with keys managed through a dedicated key management service.

Access control

Access is based on role, and every user sees only what their job needs. System credentials are issued on demand and expire on their own. Every change and approval is recorded in an audit log.

Infrastructure

Production and non-production environments are kept separate. Each bank runs on its own dedicated environment. Dependencies are checked on every deployment.

Responsible disclosure

If you find a security issue, please email Info@rifbid.com with the subject "Security Disclosure". We will acknowledge your report within 48 hours. We do not take legal action against good-faith security researchers.

Incident response

If a security incident affects user data, we will notify affected users within 72 hours of confirming it.