Security Layers
🔐 Authentication
- MFA / OTP
- Password policy + lockout
- Device binding
- Session timeout
🧱 Network
- WAF + DDoS protection
- TLS 1.3
- Rate limiting
- Private subnets
🔒 Data
- AES-256 at rest
- Field-level encryption (Aadhaar, PAN)
- Masking in UI
- Encrypted backups
🕵 Fraud
- Velocity & limit rules
- Geo / device anomaly
- Real-time alerts
- Beneficiary cool-off
📜 Audit
- Append-only log
- Every view / export logged
- Hash chaining
- Access reviews
🔧 Secure delivery
- Secrets vault / HSM
- Code review + SAST
- Annual VAPT
- Patch management
Access Control & Maker–Checker
Role matrix
| Action | Customer | Teller | Loan Off. | Branch Mgr | Admin |
|---|---|---|---|---|---|
| View own data | ✔ | — | — | — | — |
| Create entry (Maker) | Request | ✔ | ✔ | — | — |
| Approve (Checker) | — | — | — | ≤ ₹ 10 L | ✔ |
| Change rates / products | — | — | — | — | ✔ |
| Export reports | — | — | — | ✔ | ✔ |
TellerMaker
➜
Branch MgrChecker
➜
AdminFinal
➜
SystemAudit
Branch restrictions are enforced by the backend, not just by hiding screens.
Customer Protection
UPI & payments
UPI PINEntered on NPCI screen, never stored
Device bindingSIM + device check
Daily limits₹ 1,00,000 default
AlertsSMS on every debit/credit
Account safety
Block card / UPIInstant
New beneficiaryCool-off before large transfers
Login alertsNew device notification
Phishing tipsNever share OTP / PIN
Data Protection & Audit
Masked data sample
AadhaarXXXX XXXX 4821
PANABC••••4F
Mobile+91 98•••••421
Account•••• •••• 8804
Audit log sample
| Time | User | Action |
|---|---|---|
| 10:42 | Rahul J. | Approved gold appraisal |
| 10:15 | Amit K. | Exported branch report |
| 09:58 | Priya D. | Viewed CUS-100482 |
| 09:31 | Unknown | 5 failed logins → locked |
Compliance & Disaster Recovery
Compliance
RBI cyber-security guidelinesReview per bank
KYC / AML normsBuilt in
DPDP Act – consent & retentionBuilt in
PCI-DSS (card data)If cards handled
CERT-In incident reportingProcess
Resilience
BackupsDaily + tested restores
Disaster recoverySeparate site, failover drill
Monitoring24×7 alerts
Independent VAPTBefore go-live
Production release requires bank security and compliance approval.