Playbook, fintech app
A procurement reviewer and a frightened individual, typing the same word
Is your platform secure means two unrelated things on a money app. From a finance team assessing a business account it means controls, authorisation status and who holds the funds. From somebody about to move their savings it means whether they will lose everything, and it is a protection question wearing security clothes. Answering either one in the register of the other is the characteristic failure here.
Why this is not the general answer
The handling pattern for security questionnaires holds across every trade. What follows is the part that does not.
- Your authorisation is recorded on a public register that anybody can check for themselves, which makes the strongest answer in this pair a pointer to somebody else's page rather than a claim of your own.
- The corporate version asks who actually holds the money and under what permission, and that is frequently a different firm from the one whose name is on the app, so the row cannot be closed without naming the arrangement.
- The individual version is not a security question at all and must not be answered as one: reassurance about controls in place of the published protection wording is the exact substitution this trade cannot afford.
- Assessment rows here cover things a payments business has and a general software business does not, including transaction monitoring, sanctions screening and the separation of customer funds, none of which may be characterised beyond what you publish.
How it arrives
- are you actually regulated and where can i check
- who holds the money in the account
- do you screen payments for sanctions
- can you complete our vendor assessment for a business account
- how do you keep customer funds separate from your own
- is it safe to keep a large balance with you
What has to be indexed for this to work
| Your registration details as they appear on the public register | The registered name and the reference number, quoted so a reader can look you up rather than take your word for it. Getting somebody to the register in one reply is worth more than any sentence you could write about yourself. |
|---|---|
| The published description of who holds customer funds | Which entity holds the money, under what arrangement, and whether the card is issued by somebody else. This single fact answers the first row of most business assessments and the real question behind most individual ones. |
| The security material you would let a reviewer quote | Independent assessments and how they are requested, the approach to monitoring, and the route for reporting a vulnerability. Anything shared under an agreement should be described as a route rather than summarised, because a summary travels further than the document does. |
| The protection statement, kept apart from all of the above | Held as its own document so the assistant can quote it when the question turns out to be about safety of funds. Filing it inside general security material is how a careful paragraph gets paraphrased into a reassurance. |
The reply
Our registration details and reference number are published on the trust page so you can check the entry on the public register yourself rather than relying on this [1]. Who holds customer funds, and which firm issues the card, are set out there too, because they are not always the same company [2]. If you are working through a vendor assessment for a business account, I cannot complete a document or agree a term, so leave your name, your work email and the company you are asking on behalf of. If the question is whether your own money is protected, that is covered by our published protection statement rather than by anything I would summarise.
Sending somebody to the register first is the one move that makes every later sentence credible, and it costs nothing. Naming the fund holding arrangement early prevents the follow up that stalls an assessment for a fortnight. The last sentence exists to catch the individual who has landed in a corporate answer, and it hands them to a document rather than to a comforting adjective.
Where it stops
The trigger. Any request to complete, sign or return an assessment document, any question about a term, and any message where the real question turns out to be whether the person's own money is safe.
Assessment documents and contractual positions come from the team rather than from here. Leave your name, your work email and the company you are asking for, and they will send what they can share along with the route for anything that needs an agreement first.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never state or imply a permission, authorisation or registration status beyond what your published entry says.
- Never describe a control, a monitoring practice or a screening process in more detail than your own published material does.
- Never tell an individual their money is safe, since that is the protection statement's job and it is drafted word by word.
- Never confirm that an answer meets a reviewer's control, a policy or an internal standard, because that judgement belongs to the reviewer.
Questions
- Should the assistant answer security questions from the public at all?
- It should answer the ones your published material already answers and route the rest, which is a narrower job than it sounds. Registration, who holds funds and where to request more are three rows that appear in almost every assessment and can all be answered from pages you would happily print.
- Can it fill in the assessment spreadsheet a customer sends us?
- No, and it should not appear to try. It replies in chat with references back to your own pages, which is what lets a reviewer verify a claim at source. Transcribing that into their template and attesting to it is a person's job with a person's name attached to it.
- How do we stop it reassuring somebody who is just worried?
- Keep the protection statement as a separate indexed document and write the fallback so it hands over rather than comforting. The failure is not invention, it is a fluent summary of a page whose exact wording was the entire point of writing it.
Keep reading
- Everything for a fintech appFees, limits and identity checks are safe ground. Balances, transactions and anything reading as a personal recommendation are not.
- Handling security questionnaires in generalA buyer-side question arriving in the wrong place. Answer only what you publish, and never let an assistant improvise a claim you then own.
- A barrier at verification is not an inconvenience, it is a closed accountA photo capture, a liveness step and no published alternative. On a money app an access barrier stops the account working at all.
- The document exists, and the charge on it cannot be discussed hereStatements, fee breakdowns and tax paperwork on a money app. What the schedule explains, and why no charge on an account can be read.
- Publishable to the decimal point, and unquotable in the same breathMargins, thresholds and free allowances can be quoted exactly. A rate at this minute, and what a conversion costs today, cannot.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.