Cyber Security Statement

Finkey Capital Pty Ltd takes reasonable technical and organisational measures to protect the personal and financial information it holds from misuse, interference, loss and unauthorised access, modification or disclosure.

Our approach to cyber security is informed by recognised guidance, including the Australian Signals Directorate’s Essential Eight and the National Institute of Standards and Technology Cybersecurity Framework. These frameworks assist us in reviewing and improving our security practices. This statement does not represent that Finkey is certified against either framework or has achieved a particular Essential Eight maturity level.

Protecting customer information

Finkey uses established cloud-based systems to operate its customer portal and customer relationship management services. Information is transferred between authorised systems through controlled integrations.

Security measures applied according to the system, information and associated risk include:

• authenticated user access and one-time verification codes sent to a customer’s registered email address
• role-based access controls that limit access to authorised personnel with a business need
• encryption of information during transmission
• encryption at rest and encrypted data fields where supported by the relevant system
• additional protection for identifying information, including encrypted storage of identification document numbers
• system logging, monitoring and access records
• email, device, application and endpoint security controls
• security updates, vulnerability management, backups and recovery measures
• internal privacy, security and incident response procedures.

The particular controls used may differ between systems and may change as Finkey’s technology and security risks evolve.

Technology and service providers

Finkey uses third-party technology and service providers to support its systems and business operations. We consider relevant privacy and security practices when selecting and managing these providers and apply controls proportionate to the nature and sensitivity of the information involved.

Where appropriate, this may include reviewing available security information and assurance reports, applying contractual confidentiality and data protection requirements, restricting provider access, monitoring material service or security notifications and reassessing providers when circumstances or risks change.

Finkey does not represent that it directly audits every system or security control operated by each third-party provider. These providers maintain and monitor their own infrastructure under their applicable security programs and contractual arrangements.

Information about the circumstances in which Finkey may disclose personal information to service providers and other recipients is available in our Privacy Policy.

Access and authentication

Customers access Finkey’s portal using identifying information and a one-time verification code sent to the email address registered with Finkey. Additional authentication and access controls may apply to staff, administrators and other systems according to the level of access and risk.

Customers and authorised users must protect their email accounts and access credentials and must not provide verification codes or portal access to another person.

Security management and incidents

Finkey reviews and updates its security measures having regard to changes in its systems, information holdings, business operations and identified threats. Security issues and vulnerabilities are assessed and addressed according to their nature, severity and risk.

Finkey maintains processes for responding to suspected data breaches and will assess and provide notifications in accordance with the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme where applicable.

Our personnel receive privacy and cyber security information and training appropriate to their roles and responsibilities.

No internet-based service or information system can be guaranteed to be completely secure. Finkey continues to review its controls and take reasonable steps appropriate to the sensitivity of the information it holds.

For more information about Finkey’s cyber security and privacy practices, contact privacy@finkey.co.