For institutions Talk to our team

Security and trust for your diligence review

Banks and credit unions put their name on Finli, so we expect careful questions before launch. This page summarizes the controls we can document and explains how to request our security package for your vendor review.

Contact us

Controls we can document

SOC 2 Type II

Finli completed its SOC 2 Type II examination in September 2024. The report is available to institutions as part of vendor due diligence.

PCI DSS compliance

Finli is PCI DSS compliant for the card payments businesses accept through the platform.

KYC and KYB verification

Businesses are verified before they collect payments, and each business connects a verified account at its own bank or credit union for settlement.

Transaction monitoring

All payments that move through Finli are subject to transaction monitoring.

Our own flow of funds on bank rails

Finli runs its own flow of funds on bank rails rather than relying on BaaS middleware, and the money path does not change when new tools are added.

Check our work before you put your name on it

Trust Center

All 78 controls, 16 approved policies and the assurance documents we keep current — listed in full, searchable, and dated.

Privacy policy

What we collect, how it is used and how long it is kept.

Terms and conditions

The agreement that governs use of the platform.

Your brand, your relationship, your data

Finli is white-labeled. Business owners see your institution's name, not ours. The digital payments they collect through Finli settle into each business's verified account at your institution, and payments collected outside Finli can be tracked so you can see where deposits may be leaking.

The business relationship stays yours, and so does the data it generates, such as receivables aging, revenue concentration and inventory. We are glad to walk your team through how data is handled in a white-label deployment, and the details for your institution are set out in your agreement with Finli.

Finli is not a bank. Deposits and accounts are held at your institution.

How to request our security package

  1. Email us

    Ask your Finli contact, or send the request to support@finli.com with your institution's name and the person leading your vendor review.

  2. Receive the package

    We will follow up with our security documentation, including our SOC 2 Type II report, for your review.

  3. Talk it through

    Book a 30-minute call with our team to go over your questionnaire, integration questions or anything your examiners may ask about.

Common questions

Does Finli hold our customers' deposits?
No. Finli is not a bank and does not hold deposits. Payments collected through Finli settle into the business's verified account at your institution.
Which certifications does Finli have?
Finli has a SOC 2 Type II report and is PCI DSS compliant, and we run KYC/KYB verification and monitor all Finli payments. Our Trust Center lists all 78 monitored controls and 16 approved policies in full, with the date each was last reviewed.
Can we see the platform before diligence is complete?
Yes. A demo is a good first step, and many teams review the security package alongside it. If you are already talking to someone at Finli, ask them directly. If not, send the request to support@finli.com or use our contact form, and it will reach the right person the same day.

Talk to the Finli team

Questions about partnering, sponsoring a program or our security review? We answer every message.

Contact us