Built with enterprise security controls
Lendiro's infrastructure security is designed to meet the expectations of regulated financial institutions. We describe controls as implemented — we make no certification claims.
Encryption in transit & at rest
All API traffic requires TLS 1.3+. TLS 1.0 and 1.1 are disabled. Transaction data and decision records are encrypted at rest using AES-256.
Access control architecture
API key authentication with scoped permissions. IP allowlist per API key for production environments. Webhook delivery signed with HMAC-SHA256 for payload verification.
Data minimization by design
Lendiro processes transaction metadata (date, amount, category, recurrence flag) — not raw consumer PII. Name, SSN, and address are never required by the decisioning API.
What data we process, how long we keep it
Transaction data processing
Lendiro processes bank transaction data submitted via API request. Transaction records are processed in memory to extract signal features — the raw transaction payload is not persisted beyond the active request session unless lender explicitly opts into transaction storage for audit purposes.
Decision records (output fields: score, signals, reason codes, timestamp, model version) are stored per decision ID in your account and are available for retrieval indefinitely within the terms of service.
Retention and deletion
Transaction payloads: processed and discarded within the request cycle unless transaction storage is opted into. Decision records: retained until account closure or explicit deletion request. Deletion requests processed within 30 days.
See our Privacy Policy for complete data handling terms. API key rotation is available at any time through the API.
Data classification
| Data Type | Classification | Retention |
|---|---|---|
| Transaction payloads | Transient processing | Request cycle only |
| Decision records | Account data | Until account close |
| API keys (hashed) | Credential | Until rotated |
| Audit logs | Operational | 90 days rolling |
| Access logs | Security | 90 days rolling |
Review our security documentation
Security questionnaires and vendor review documentation available on request. Talk to the team if your organization has specific security requirements for API vendors.
Email: [email protected]