Your bank data, kept private and kept safe
Your limits, deals and dues are sensitive. Mero Loan protects them with several separate layers, so no single mistake is enough to expose them.
Sign-in
- A sign-in for each person, such as ram@yourcompany. Nobody shares a password
- Two-factor sign-in with an authenticator app: required for administrators, available to everyone
- Passwords are stored only in a form that cannot be turned back into the password
- Accounts lock after five wrong attempts; sessions end after 30 minutes without use
Your organisation, kept apart
- Each organisation's records are kept apart by the database itself, not only by the application
- Every change is checked on our server against the person's role: Administrator, Approver, Data Entry or Retrieval Only
- Approval by a second person, where you want it, before a deal counts
Encryption and backups
- Encrypted on the way (HTTPS only) and where it is stored
- Hosted with Amazon Web Services in Mumbai, behind Cloudflare's network protection
- Automatic backups that can restore to any moment, with a copy kept in a second region
A record of every change
- Who changed what, when, and the values before and after
- Each entry is signed and linked to the one before it, so an edit made outside Mero Loan shows up
- Your administrators can check the whole record with one click
Our own staff
- Mero Loan staff use a separate, protected admin area, with a fresh two-factor code for every change
- They can change your subscription or reset your administrator's password, but not your records
- Anything they do to your account appears in your own record of changes, with the reason
In your browser
- A strict browser security policy stops scripts that are not ours from running in the app
- Requests from other websites are refused
- Pages holding your data are never kept in the browser's cache
What we promise, and what nobody can
No one can honestly promise that a system can never be attacked. What we do is make an attack hard and limit the harm if one ever succeeds. We use several independent layers, keep everything up to date, test the service before every change, and practise restoring from backup.
Your data is yours. We do not sell it or share it, and we look at it only to give you support you have asked for. When an agreement ends, you receive a full export before anything is deleted.
Where is our data stored?
With Amazon Web Services in its Mumbai region, with backup copies in a second region. All of it is encrypted.
Who at Mero Loan can see our data?
Only a small number of named staff, and only when needed to support you. Every action our staff take on your account is recorded and appears in your own record of changes.
We are moving from the OneDrive version. Is our passphrase sent to you?
No. Your administrator opens the OneDrive data in their own browser with the passphrase. Only the records are sent, over an encrypted connection, and they are checked against the original figures before anything is saved.
How do we report a security concern?
Contact us using the details on our contact section. We look into every report.
Questions about security?
We are happy to go through how Mero Loan protects your data with your team or your auditors.