Secure development
How changes reach production, what gates them, and how a change is traced back afterwards.
Last updated 23 July 2026 · Trust Center
1. Lifecycle
Changes move through source control, automated build, automated test and a reviewed release. No change reaches production without a recorded approval, and the approval is attributable to a person.
2. Review and separation
Changes are peer-reviewed before merge. Production deployment is separated from authorship for changes affecting authorization, ledger integrity or reporting — the same segregation-of-duties principle the platform enforces for your users applies to the people who build it.
3. Dependencies
Third-party dependencies are inventoried and monitored for known vulnerabilities, and updates are prioritised by exploitability and exposure rather than by score alone. A dependency that reaches end of support is treated as a defect with a date, not a backlog item.
4. Secrets
Credentials and keys live in managed secret storage. They are never in source control, never in client-side code, never in a support ticket and never in a log. Rotation is routine rather than incident-driven, and a suspected exposure is treated as an exposure.
5. Environments
Non-production environments are for configuration, integration and testing. They must not hold production personal data unless the order form expressly permits it — which is a contractual restriction in the licence, not only a practice. All environments run on Azure; region is per data residency.
6. Traceability
A behaviour in production traces to a release, a change and an approval. That is what makes “when did this rule change and who changed it” answerable during an examination — see examination support.
Financial Infrastructure, Inc. is a technology provider and is not a bank, trust company, broker-dealer or investment adviser. Nothing on this page is legal, regulatory, tax or investment advice. Institutional Trust Company is a proposed trust entity seeking a South Dakota non-depository trust charter; it is not yet chartered and is not accepting accounts.
Questions about this document? Contact security@a8core.com or write to Financial Infrastructure, Inc., PO Box 1410, Menlo Park, California 94026-1410.