Skip to content
AtheronLABS

You're visiting from the United States. Prices are shown in US dollars. Not right?

labs@atheron:~/industries/finance/compliance$ audit --controls --evidence

Fintech compliance

SOC 2 and PCI DSS controls, built into the product.

Banks and enterprise customers ask a fintech for a SOC 2 report before they sign, and card payments bring PCI DSS. We build the controls into the product from the start and support your audit, so the report is a step in the sales process rather than a rebuild.

Start a projectSee the example projects

// what matters here

What is different in this industry.

01

PCI scope follows the payment design

Card data taken by a processor's hosted checkout keeps most systems out of scope. We design payments so the smallest scope that fits your product is the one you get.

02

SOC 2 controls in the product

Access by role, audit logs, encryption, change management and monitoring built in, and mapped to the criteria your auditor tests.

03

Evidence as you go

Evidence collected in your compliance platform as the work happens, so the observation window for a Type II report starts on a working system.

04

Reports from independent auditors

We support your audit; the SOC 2 report or the PCI assessment comes from an independent auditor or assessor you choose.

// example projects

Priced examples for this service.

Each one is hypothetical, labelled as such, and priced live from our rate card. Open any of them in the estimator and make it yours.

Example projectWeb appMobile app

Consumer loan app with ID checks

Hypothetical. Not a client, not a result.

// The problem

A lender takes applications through a web form and email, so identity checks, bank data and documents are chased by hand and many applicants never finish.

// What we would build

An iOS and Android app with a matching web portal that verifies identity, links the bank account, collects documents and shows the applicant where their file stands, with a back office for the credit team.

// What is in it

  • Identity verification and bank account linking inside the application flow
  • Document capture with the phone camera, checked for blur before upload
  • Application status, repayments and statements for the borrower
  • A back office for credit staff with an audit trail on every decision
  • English and French throughout, with notices sent by push and email

// Stack

  • Next.js
  • React Native
  • PostgreSQL
  • Flinks or Plaid for bank data
  • Identity verification API
  • AWS Canada

// estimate

Build
≈ US$249,000 to US$381,000, delivered within 39 weeksCAD 354,400 to 542,000
Hosting
≈ US$492 a monthCAD 700 a month
Support
≈ US$5,010 a monthCAD 7,135 a month

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery
2.9 to 3.4 weeks
Design approved
10.9 to 18.4 weeks
Core features
2.4 to 3.9 weeks
Full build
1.4 to 2.4 weeks
First build on devices
4.9 to 7.9 weeks
Testing and fixes
0.4 to 0.9 weeks
Store submission
0.4 to 0.9 weeks
Regulatory reports accepted
0.9 weeks
Controls built and evidenced
0.9 weeks
Readiness review
0.9 weeks
Launch
0.9 to 1.4 weeks
Audit support and remediation
0.9 to 1.4 weeks
Observation window (auditor)
26 weeks
Auditor report (SOC 2 Type II)
4 to 8 weeks

Outside our hands, and added to the calendar

App store review
1 week
Sandbox and API access from the vendor
1 to 4 weeks
Booking a penetration tester and their report
2 to 4 weeks

How it is paid

Deposit 20%
CAD 70,880 to 108,400
Discovery 5.9%
CAD 20,909.60 to 31,978.00
Design approved 5.9%
CAD 20,909.60 to 31,978.00
Core features 4.8%
CAD 17,011.20 to 26,016.00
Full build 3.2%
CAD 11,340.80 to 17,344.00
First build on devices 12.8%
CAD 45,363.20 to 69,376.00
Testing and fixes 1.6%
CAD 5,670.40 to 8,672.00
Store submission 4.2%
CAD 14,884.80 to 22,764.00
Regulatory reports accepted 6.3%
CAD 22,327.20 to 34,146.00
Controls built and evidenced 6.3%
CAD 22,327.20 to 34,146.00
Readiness review 6.3%
CAD 22,327.20 to 34,146.00
Launch 5.9%
CAD 20,909.60 to 31,978.00
Audit support and remediation 6.8%
CAD 24,099.20 to 36,856.00
Holdback, 30 days after launch (10%)
CAD 35,440 to 54,200
Start from this example
Example projectWeb appBlockchain

Partner settlement ledger

Hypothetical. Not a client, not a result.

// The problem

A payments company and its partner institutions each keep their own record of transfers and settlements, and month end is a dispute over whose record is right.

// What we would build

A private permissioned ledger where each party runs a node and every transfer and settlement is written once and read by all, with a web console for operations staff. If one party is trusted to keep the record, a shared database is cheaper and we will say so.

// What is in it

  • Settled amounts posted to the books in QuickBooks Online, built on the QuickBooks Online API
  • A node for the company and for each partner institution
  • Transfers and settlements recorded once, with each party's signature
  • Breaks flagged the day they happen, not at month end
  • A console for operations to investigate and resolve a break
  • Exports for auditors and each partner's own systems

// Stack

  • Hyperledger Besu (private, permissioned)
  • Next.js
  • PostgreSQL
  • Kafka
  • AWS

// estimate

Build
≈ US$164,000 to US$251,000, delivered within 44 weeksCAD 233,300 to 356,800
Hosting
≈ US$492 a monthCAD 700 a month
Support
≈ US$2,500 a monthCAD 3,565 a month

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery
2.9 to 3.4 weeks
Architecture
0.4 weeks
Data mapping and sandbox connection
0.4 weeks
Design approved
2.9 to 4.9 weeks
Core features
1.9 to 3.4 weeks
Full build
1.4 to 2.4 weeks
Devnet
4.4 to 7.4 weeks
Sync built and reconciled in sandbox
1.4 to 2.4 weeks
Testing and fixes
0.4 weeks
Testnet
2.9 to 3.4 weeks
Regulatory reports accepted
2.9 to 3.4 weeks
Controls built and evidenced
2.9 to 3.4 weeks
Readiness review
2.9 to 3.4 weeks
Launch
0.9 to 1.4 weeks
Mainnet
0.9 to 1.4 weeks
Live cutover
0.9 to 1.4 weeks
Hypercare
0.9 to 1.4 weeks
Observation window (auditor)
26 weeks
Auditor report (SOC 2 Type II)
4 to 8 weeks

Outside our hands, and added to the calendar

Sandbox and API access from the vendor
1 to 4 weeks
Readiness review with your auditor
6 to 12 weeks
Booking a penetration tester and their report
2 to 4 weeks

How it is paid

Deposit 20%
CAD 46,660 to 71,360
Discovery 1.5%
CAD 3,499.50 to 5,352.00
Architecture 4%
CAD 9,332 to 14,272
Data mapping and sandbox connection 1.1%
CAD 2,566.30 to 3,924.80
Design approved 1.5%
CAD 3,499.50 to 5,352.00
Core features 4.5%
CAD 10,498.50 to 16,056.00
Full build 3%
CAD 6,999 to 10,704
Devnet 12.2%
CAD 28,462.60 to 43,529.60
Sync built and reconciled in sandbox 3.3%
CAD 7,698.90 to 11,774.40
Testing and fixes 1.5%
CAD 3,499.50 to 5,352.00
Testnet 8.1%
CAD 18,897.30 to 28,900.80
Regulatory reports accepted 7%
CAD 16,331 to 24,976
Controls built and evidenced 7%
CAD 16,331 to 24,976
Readiness review 7%
CAD 16,331 to 24,976
Launch 1.5%
CAD 3,499.50 to 5,352.00
Mainnet 4%
CAD 9,332 to 14,272
Live cutover 1.1%
CAD 2,566.30 to 3,924.80
Hypercare 1.7%
CAD 3,966.10 to 6,065.60
Holdback, 30 days after launch (10%)
CAD 23,330 to 35,680
Start from this example

// questions

Questions we get about this.

Do we need SOC 2 before our first bank customer?

Often the bank's vendor review asks for it, or for answers to the same questions. A Type I report is the usual first step, followed by Type II.

Which PCI DSS questionnaire applies to us?

That depends on how card data flows. A hosted checkout usually means the shortest questionnaire; we design the flow with you and your assessor confirms the scope.

Can you run the audit?

No. We build to the controls and support the audit; the report is issued by an independent auditor.

Back to the industry: Finance and fintechAbout the service: Compliance and security engineering

// next

Not quite your project?

Tell us what you have in mind. We will come back to you with a range and the questions that would narrow it. Or book a call and talk it through.

Start a projectBook a call
SOC 2 and PCI DSS engineering for fintech products | Atheron Network Labs