FinSuite · Security
PTAS FinSuite Security
Finance data needs controls you can name. These are FinSuite's.
Where the agent stops
What FinSuite does, and what stays with your people
FinSuite does the preparation that fills a payables team's day. The decisions that move money stay with named people.
Each control below exists to hold that line. Approval bands decide which person, segregation of duties decides which people cannot be the same person, the ERP grant limits what the integration can touch, and the bank-detail check covers the request most likely to be fraudulent. The audit trail is how you prove all of it afterwards.
Approval bands
The amount decides who approves
Approvers are defined by role, amount, cost centre and legal entity. The agent prepares, routes and reminds. It does not approve.
Invoice ₹ 2,70,220 — the route it took · Illustrative example
Nobody shared a login and nobody chased by email. The delegation, the timestamp and the reason are all on the entry.
An invoice reaches an approver only after the duplicate check, the terms and tax check and the match have passed, so the approver decides on a clean invoice with the evidence beside it. Delegation covers absence and escalation after a set wait, without anyone sharing a login, and the delegate is named on the entry.
The bands themselves are configuration with an owner. Moving a threshold is a change like any other: it records who made it and when, and decisions taken under the old band keep the band they were taken under.
Segregation of duties
No one person creates, approves and pays
The split is enforced by role. It does not rely on people remembering a policy document.
Illustrative example: one invoice, four people
Illustrative data. The audit record shows each person acting inside their own role, which is what an auditor testing segregation asks to see.
Three rules carry most of the weight. Whoever creates or changes a vendor cannot approve that vendor's invoices. Whoever codes an invoice cannot approve it. Whoever approves cannot release the payment. Smaller finance teams sometimes find the third one uncomfortable, because the same two people do everything. That conversation belongs at assessment, before the roles are configured, and the answer should be a decision your controller signs, written down.
ERP write permissions
FinSuite can only do in your ERP what you granted
The connection signs in as an integration user your team creates. Its rights are set in your ERP, by your people.
Illustrative example: what one integration user was granted
Illustrative data. The grant lives in your ERP, set by your team, and can be withdrawn there at any time without asking us.
Each agent has one job and only the permissions that job needs, and it cannot act outside the integration your IT team approved. In practice that means the integration user can read what matching needs and post what approval allowed. Creating vendors, changing bank details and releasing payments stay with roles held by people, unless your own process decides otherwise and grants it.
Every call the integration makes is logged with the document it came from and the document number the ERP returned. Credentials are stored encrypted, and your team can disable the user in the ERP at any time without involving us. How each system is connected is on FinSuite Integrations.
Bank detail changes
A bank detail change never applies quietly
It re-runs verification, raises an approval task and is recorded against the vendor with the evidence attached.
Illustrative example: a bank detail change request
Illustrative data. Invoice fraud usually arrives as a plausible request to update payment details, which is why this path is deliberately slow.
A vendor can submit a change through the portal, and it still waits. The new account is checked at source with a penny-drop against the legal entity's name, and compared with every other vendor's account in the master. A change cannot be applied from an inbound email, however convincing the letterhead.
This is the one path in FinSuite we deliberately keep slow. A day's delay on a genuine change costs a supplier a day. A fraudulent change applied quietly costs the payment, and usually the next few as well. FinSuite Vendor Management covers the rest of the vendor master controls.
Audit trail
Every decision, kept with its evidence
A log line saying an invoice posted is not evidence. FinSuite keeps what was read, which rule applied, who decided and what the ERP confirmed.
One decision, kept in full · Illustrative example
This is what separates an agent from an automation: it can tell you why, months later, without anyone reconstructing it.
Actor and time
Every read, check, decision and posting carries who or what acted, and when.
Rule version
The rule set in force at the time is kept with the decision, so a later change does not rewrite the past.
Exportable
In a form your auditors can work with, for internal and statutory audit.
Data protection
Encryption, access and where FinSuite runs
The same company-wide controls as every PTAS AI product, applied to vendor records, invoices and bank details.
In transit and in storage
Encryption
Invoices, vendor records and bank details are encrypted in transit and in storage. Key management follows the deployment model you choose.
Set by role
Role-based access
Who can see a vendor's bank details, approve an invoice or change a rule is set by role, and the role is recorded on every action.
Where supported
Deployment
Cloud, private cloud, or on-premise and air-gapped where supported. Retention follows your policy, and every deletion is recorded.
Our security practices are aligned with ISO/IEC 27001 and our delivery practices with ISO 9001, and we design for GDPR readiness where customers process EU personal data. We are not certified against any of them. If your review needs evidence for a specific control, an engineer will walk through how it works in the deployment model you are considering.
FAQ
Questions finance controllers and auditors ask
Can FinSuite approve an invoice on its own?
No. The agent prepares the invoice, routes it to the approver the band requires and sends the reminders. A person with the right limit approves it, and the approval is recorded with their name, the band and the time.
How is segregation of duties enforced?
By role. Whoever creates or changes a vendor cannot approve that vendor's invoices, whoever codes an invoice cannot approve it, and whoever approves cannot release the payment. The record shows each person acting inside their own role, which is the evidence an auditor testing the control asks for.
What can FinSuite do inside our ERP?
What the integration user your team created is authorised to do, and nothing more. In most rollouts that means reading masters, purchase orders and goods receipts, posting approved invoices and reading payment status. The grant is set in your ERP and can be withdrawn there at any time.
What happens when a vendor changes its bank details?
The change never applies silently. It re-runs verification, raises an approval task and is recorded against the vendor with the evidence attached. It cannot be applied from an inbound email. Invoice fraud usually arrives as a plausible request to update payment details, so this path is deliberately slow.
Is FinSuite ISO 27001 certified?
No. PTAS AI security practices are aligned with ISO/IEC 27001 and delivery practices with ISO 9001, and we design for GDPR readiness. We hold none of these certifications and do not claim to. We are glad to walk your security and audit teams through the controls themselves.
Can our auditors get the audit trail?
Yes. Every read, check, decision and posting is recorded with the actor, the time, the rule version and the evidence, and it exports in a form your auditors can work with.
Keep reading
Related reading
Security
The company-wide controls, deployment models and incident handling this page applies to FinSuite.
Read more →FinSuite Vendor Management
Onboarding, verification at source and change control on the vendor master.
Read more →FinSuite Integrations
How FinSuite connects to your ledger, and what the integration user may do.
Read more →Human-in-the-Loop AI
How review thresholds work, and why review is a control.
Read more →Next step
Bring your approval matrix
The assessment asks how invoices are approved, who can change a vendor and how payments are released today. The result shows which controls FinSuite would enforce from the first run, and where your current split needs a decision.