Sign inRequest Early AccessEarly Access
All productsPaymentsCollectionsBusiness FinanceInsightsLedgerInvoicesExpensesHealthcareMerchant PlatformAutomationDevelopersSecurityPricingCompanyContactSign inRequest Early Access
Security

Security Built Into Every Layer

Designed with security and compliance best practices in mind. Etiquette has not obtained third-party security certifications, and we say so plainly.

Implemented in the preview
  • Two-factor authentication (TOTP) with recovery codes; mandatory for staff accounts
  • Sign-in lockout and rate limiting on authentication and public forms
  • Salted, adaptive password hashing and short-lived access tokens with rotating, HTTP-only refresh cookies
  • HTTPS everywhere with HSTS and secure headers
  • Append-only audit log: database triggers block edits and deletes
  • Immutable double-entry ledger: posted entries cannot be changed, corrections are reversing entries
  • Field-level encryption for stored webhook secrets
  • Signed (HMAC) webhook verification for payment events
  • Role-based access with strict per-organisation isolation on every request
  • Provider adapter layer; credentials only from environment variables
  • Documented backup and restore drill
Planned
  • Fraud monitoring and anomaly rules
  • IP monitoring and new-device alerts
  • Device and session management screen
  • WebAuthn / passkeys
  • API key authentication and scopes
  • Infrastructure-level encryption at rest
  • Formal disaster recovery plan and tested RTO/RPO
  • Independent penetration test
  • Third-party certifications (none held today)
Compliance

Compliance by design

The architecture is built to accommodate the following. These are design considerations, not statements of approval or certification.

  • RBI regulations and the RBI payment ecosystem requirements
  • PCI DSS where card data is relevant (card data stays with partners)
  • KYC / KYB
  • AML controls and PMLA requirements where applicable
  • Digital Personal Data Protection Act, 2023
  • GST regulations
  • Financial record retention
  • Audit logs
Etiquette is not RBI approved or licensed. Etiquette Bank is a financial technology initiative of Etiquette. Etiquette is not representing itself as a licensed bank. Banking, payment, credit or regulated financial services, where offered, may be provided through appropriately licensed and regulated partner institutions. Product availability is subject to applicable regulations, eligibility and partner arrangements.