Skip to main content

Security & access for partner banks

This page explains concepts your CISO and IT integration lead care about. It does not document internal Decision PRO engineering files.

Authentication & MFA (multi-factor authentication)​

  • MFA means users prove something they know (password) plus something they have (app code, hardware token, SMS where allowed by policy)-exact methods depend on your bank’s standards and deployment.
  • AIS and your bank typically agree whether SSO (single sign-on) is mandatory and which identity provider is authoritative.

:::caution No credentials in this portal

Never use this site to share live passwords, recovery codes, or API keys. Use your bank-approved secret manager and AIS secure channels.

:::

RBAC (role-based access control)​

  • RBAC means permissions are bundled into roles (e.g., analyst vs approver) instead of hand-tuning every user.
  • Good RBAC supports segregation of duties-the same person should not always create and approve high-risk changes without oversight (bank policy).

How Decision PRO applies it (conceptual): the product combines menu and route access with action-level checks (for example only certain roles may press approve on a loan). Sensitive pages are also protected on the server for browser traffic (so users cannot bypass the UI by crafting requests). Users who lack permission typically see a clear “access denied” experience rather than silent failure. Permission names are designed to line up with Pro Gateway capabilities where the two products are integrated-exact matrices are deployment-specific.

Exact permission names - subject to deployment configuration.

Auditability​

  • Audit trails record significant actions (who changed what, when)-useful for internal audit and dispute handling.
  • Export formats for committees may combine Decision PRO fields with core banking facts-confirm with your AIS account team.

Sessions & timeouts​

  • Sessions are time-bound so unattended workstations do not leave customer data exposed.
  • Timeout length, re-auth prompts, and “stay signed in” behavior are deployment-specific-your security team should review them against your desktop standards.

:::note Neutral example only

A bank might choose a 60-minute session with a 5-minute idle warning-illustrative, not a recommendation or default.

:::

Next: Troubleshooting (bank view) · Compliance & risk · Overview