Security

We protect what you value most.

For a factoring company or a fund, its portfolio is its most valuable asset. For a business, it is its data. We protect both with a certified information security management system.

Request ISMS documentationHow we handle credentials

Certification

ISO/IEC 27001:2022

Certification body
DNV
Certificate no.
C842128
Valid
until March 2027
Scope
The Fapro platform (SaaS): extraction, processing and delivery of information to clients

For factoring companies and funds

Your portfolio is yours.

  • Only your team and the users you enable can see it.
  • A fund only receives the deal you decide to send it.
  • If your risk team needs to review our ISMS, we share the documentation.
See the documentation available

For businesses

Were you asked to connect your SII credentials?

Here is what Fapro does with them, what it never does, why it pays off for you and how to cut off access whenever you want.

Read the guide for businesses

Your SII credentials

The invoice travels; your credentials don’t.

The business provides its credentials under a mandate. Fapro only reads information from official sources, such as the SII and the TGR, with audited controls.

  1. Read-onlyWith a company’s credentials we only read; we never issue or change its documents.
  2. EncryptedStored encrypted, and no one at Fapro can see them. Only the system uses them to read official sources.
  3. RevocableThe company cuts off access whenever it wants, for whoever it wants.
  4. Who sees the informationOnly the factoring company the business gave access to, and the users that factoring company enabled in Fapro.
  5. How access is revokedBy emailing ayuda@fapro.app or seguridad@fapro.app.

Controls

How we protect information.

These are the controls of our information security management system (ISMS), audited by DNV.

  • Encryption

    Information is encrypted in transit and at rest.

  • Two-factor access

    Each person can only access what they need, with multi-factor authentication and periodic permission reviews.

  • Event logging

    Platform logs are centralized for review.

  • Vulnerability management

    We review our systems and applications, and run penetration tests with an external provider.

  • Infrastructure on AWS

    We run on Amazon Web Services, with its physical and network security.

  • Backups and continuity

    We back up information and manage service continuity within the ISMS.

ISMS documentation

What we publish and what we share under confidentiality.

Does your risk, IT or compliance team need to review how we manage security at Fapro? We share the documentation of our management system once a non-disclosure agreement is signed.

Public · on this page

  • The ISO/IEC 27001:2022 certification and its scope
  • How we handle SII credentials
  • Our main controls
  • The providers that process data
  • How to report a vulnerability

Under a non-disclosure agreement

  • ISO/IEC 27001:2022 certificate issued by DNV
  • Statement of Applicability (SoA)
  • ISMS policies: access, encryption, continuity and incidents
  • Platform architecture and data flow
  • Answers to your security questionnaire
Request documentation

Email us at seguridad@fapro.app.

Subprocessors

Providers that process data.

The main ones. We assess every provider each year within our ISMS.

ProviderPurpose
Amazon Web ServicesPlatform infrastructure and storage
Google WorkspaceEmail and working documents
GitHubCode repositories
SendGridPlatform email delivery
CorvusPenetration testing

Incidents

If something happens, we tell you.

We have an incident management procedure. If an incident affects your information, we notify you and tell you what we did.

Responsible disclosure

Found a vulnerability?

Email seguridad@fapro.app or ayuda@fapro.app with the subject “Security”. We will reply, and we take no action against anyone who reports in good faith.

FAQs

What risk teams usually ask.

Does Fapro know a company’s SII credentials?

The credentials are stored encrypted and no one at Fapro can see them. Only the system uses them to read information from official sources, such as the SII, Chile’s tax authority, and the Chilean Treasury (TGR).

Who sees my factoring company’s portfolio?

Only your team, with the users you enable in Fapro. A fund only receives the deal you decide to send it through Smart Funding.

What does a fund see of the deals I send it?

The deal and the debtor’s source data. What is shared about the issuer is defined by the agreement between the factoring company and the fund.

Our risk team has a security questionnaire. Will you fill it in?

Yes. Send it to seguridad@fapro.app and we’ll answer it under a non-disclosure agreement.

Does Fapro sell or share companies’ information?

No. A company’s information is only seen by whoever it authorized through its mandate.

Need to review our ISMS?

We send you the documentation of our security management system, under a non-disclosure agreement.

Request documentation