Security
Protecting business funds and financial data
endl is incorporated in DIFC Dubai. Regulated banking partners hold client funds in segregated accounts, separate from endl operating funds.
Client funds segregated
Regulated banking partners hold all client balances in segregated accounts. Funds are never used for endl operations and remain identifiable as client money.
Encryption throughout
TLS 1.3 encrypts data in transit, while AES-256 protects it at rest. Sensitive fields receive application-layer encryption before storage. Keys are managed through a dedicated key management service.
DIFC legal framework
endl is incorporated in the Dubai International Financial Centre (DIFC) and registered with the DIFC Authority. DIFC's English common law framework supports structured client fund protection and dispute resolution.
Access and authentication
Every endl account requires MFA. Administrator actions, including adding payees, changing account details, or initiating large payments, require approval from a designated second approver.
Role-based access supports view-only, payment-initiation, and administrative permissions. Access logs remain available to account administrators and are retained for 12 months.
Monitoring and fraud controls
endl monitors every payment flow. Unusual activity, including new-payee payments above threshold, velocity anomalies, or off-hours initiations, triggers an automated hold for manual review.
A dedicated fraud operations team reviews flagged transactions 24 hours a day. Customers receive real-time alerts for every transaction initiated from their account.
Data Handling
How endl manages business data
Data location
Primary data and encrypted backups are held in UAE-based cloud infrastructure, with backups in a secondary region. Data does not leave the UAE and GCC without explicit customer consent.
Retention rules
Transaction records remain for seven years, consistent with DIFC financial record-keeping practice. Personal data stays only as long as required for regulatory purposes or the active account relationship.
External audits
Periodic third-party security assessments cover application penetration testing and infrastructure review. Customers may request summary findings under NDA.
Incident response
If a security incident affects customer data, endl will notify affected customers within 72 hours of confirming the breach. A dedicated incident response team remains on call at all times.
Questions on security?
Our team can guide your finance or IT team through our security documentation and controls.