Security & compliance, built into the core
Sika holds regulated financial data and moves real money, so security is not a feature — it is the foundation. Strict tenant isolation, a conserving double-entry ledger, encryption, and deny-by-default access, with controls aligned to ISO/IEC 27001:2022 and Bank of Ghana requirements.
We describe our posture accurately: items marked “in progress” are underway, not yet certified. Full documentation is shared with prospective institutions under NDA.
How Sika protects your institution
Tenant isolation
One institution can never see another’s data — enforced in code, tested, and guarded at the database.
- Per-tenant scoping injected into every query
- Database-level tenant safety net flags unscoped queries
- Platform features restricted to the Sika org, not tenants
- End-to-end isolation test suite
Money integrity
A conserving double-entry ledger with controls that make silent balance drift impossible.
- Idempotent, atomic postings — no double-spend
- Maker-checker segregation of duties
- Reconciliation gate before resuming after any incident
- Conservation invariants covered by tests
Encryption & secrets
Sensitive data is protected at rest and in transit; secrets are validated fail-closed.
- AES-256-GCM field encryption; argon2id password hashing
- TLS in transit; signed (HMAC) payment webhooks
- PII and national-ID masking in logs and views
- Production refuses to start on placeholder secrets
Access control
Deny-by-default authorization with strong authentication and clean privilege separation.
- Server-side, deny-by-default role-based access control
- MFA for staff; JWT rotation with reuse revocation
- One-time set-password links — no passwords by email
- Immutable audit log of security-relevant actions
Compliance controls
The technical controls regulated institutions need, aligned to ISO 27001:2022 and Bank of Ghana.
- Tiered KYC and Ghana Card e-KYC
- AML, sanctions, and PEP screening
- Immutable audit trails and reporting
- PCI SAQ-A card handling via hosted checkout
Resilience
Backups, disaster recovery, and incident response — with money movement safe by default.
- Backup and DR runbooks with restore/failover drills
- Reconcile-before-resume enforced in code
- Incident-response and business-continuity plans
- Secure SDLC: CI lint, typecheck, tests, dependency + image scans
Review our security with your team
We share the Statement of Applicability, architecture, and risk posture with prospective institutions under NDA.
Governance and assurance
Sika operates an information security management system aligned to ISO/IEC 27001:2022, with a Statement of Applicability mapping every Annex A control, a documented risk treatment plan, and defined incident-response and business-continuity procedures.
Security is verified continuously in our delivery pipeline — linting, type-checking, an extensive automated test suite (including financial-integrity and tenant-isolation invariants), dependency auditing, and container image scanning run on every change.
Before handling real customer funds, each deployment passes a security readiness gate and an independent penetration test. We disclose our security status honestly and share full documentation under NDA.
Security & compliance: FAQ
How secure is the Sika banking platform?
Sika is engineered security-first: strict per-tenant data isolation, a double-entry ledger with automated reconciliation, AES-256-GCM field encryption and argon2id password hashing, deny-by-default role-based access control, and immutable audit logs. The platform fails closed — it refuses to start or to move money on unsafe configuration. Controls are aligned to ISO/IEC 27001:2022.
Is Sika ISO 27001 certified?
Sika’s controls are built and mapped to ISO/IEC 27001:2022, with a Statement of Applicability, risk treatment plan, and incident-response and business-continuity plans in place. Formal certification and an independent penetration test are in progress; we share our security posture with prospective institutions under NDA.
How does Sika keep one institution’s data separate from another’s?
Every tenant’s data is scoped by a bank identifier that is injected into every query and verified in code, with automated tests and a database-level guard that flags any unscoped tenant query. Platform-wide, cross-tenant features are restricted to the Sika platform organisation and are unreachable by any tenant operator. Isolation is verified by an end-to-end test suite.
Is Sika PCI DSS compliant for card payments?
Sika uses hosted checkout for card payments, so card data never touches our servers — this keeps card handling at the lowest PCI scope (SAQ-A). Mobile money and bank transfer add no card exposure.
Where is customer data stored, and does Sika support data residency?
Sika is architected for in-region deployment per market, so data residency requirements can be met country by country. Currency, national-ID verification, and payment rails are country-pluggable, so each market runs the same platform on locally-appropriate infrastructure.
How does Sika protect money movement from bugs or attacks?
Money moves through a double-entry ledger with idempotent, atomic postings, maker-checker segregation of duties on sensitive actions, and a reconciliation gate (balance equals transaction history) that must pass before writes resume after any data-tier event. Fraud rules monitor transactions in real time and can hold suspicious activity for review.
Launch your institution on Sika
From application to a live, compliant bank in weeks, not years.