15+ years
Cloud banking experience
Trust is built on evidence
Ohpen’s platform administers more than €150 billion in assets for financial institutions. See how we protect your data, support regulatory compliance and keep critical banking operations resilient.
Trusted by Europe’s leading financial institutions
€150B+
Assets under administration
0
Unplanned downtime since launch
<5 min
Recovery time objective
24/7
Operational monitoring and response
160+
Certified Engineers
Platform Assurance
Trust by design
Clear controls, established standards and ongoing oversight provide assurance across the platform and its operations.
Platform security
Cloud-native security
Every Ohpen client environment runs exclusively on AWS in the EU, with security controls embedded across infrastructure, data, access and operations.
- Encryption at rest using AWS KMS and in transit
- Least-privilege RBAC, federated identity and four-eyes approval
- Client identity integration through Amazon Cognito
- Penetration testing, vulnerability scanning and continuous threat detection
- Annually tested procedures aligned with DORA and industry standards
- Employee background screening and annual security awareness training
Assurance and regulatory alignment
Independent assurance
Ohpen’s security and control framework is independently assessed and audited, while our platform and services are designed to support clients operating under EU and UK regulatory requirements.
Data privacy
Your data stays in the EU
Personal data is processed only on client instructions, with clear controls over how it is accessed, used and retained.
- Data Processing Agreement included in every client contract
- Ohpen acts as Data Processor, clients remain Data Controllers
- Anonymised or synthetic data used in non-production environments
- Automated deletion supports defined GDPR retention periods
Operational resilience
Built for resilience
The platform runs across three AWS Availability Zones in Ireland, with automatic scaling and recovery. Hourly database backups are replicated to Frankfurt, supported by annually tested continuity and recovery plans.
- 99.9% uptime SLA for Savings and Investments, 99.8% for Mortgages
- <5-minute RTO and RPO for Availability Zone outages
- 4-hour resolution target for critical P1 incidents
- Controlled releases designed to minimise service disruption
- Contractual safeguards supporting service continuity
Transparency and reporting
Full transparency
Ohpen provides clear communication around incidents and platform changes, with client interactions tracked through CCDESK for a complete audit trail.
- Major security incidents reported in line with agreed requirements
- Root Cause Analysis shared following confirmed security incidents
- Deployment calendars shared in advance with defined approvals
- Contractual audit rights for clients and regulators
Third-party risk management
Trusted dependencies
Third-party providers are assessed and monitored through Ohpen’s vendor management framework, with oversight based on their role, risk and criticality to our services.
- Risk and criticality determine the level of oversight applied
- Provider performance and risk are reviewed throughout the relationship
- Critical dependencies are incorporated into resilience and continuity planning
Cloud infrastructure provider
Cloud-native security
Every Ohpen client environment runs exclusively on AWS in the EU, with security controls embedded across infrastructure, data, access and operations.
- Encryption at rest using AWS KMS and in transit
- Least-privilege RBAC, federated identity and four-eyes approval
- Client identity integration through Amazon Cognito
- Penetration testing, vulnerability scanning and continuous threat detection
- Annually tested procedures aligned with DORA and industry standards
- Employee background screening and annual security awareness training
Independent assurance
Ohpen’s security and control framework is independently assessed and audited, while our platform and services are designed to support clients operating under EU and UK regulatory requirements.
Your data stays in the EU
Personal data is processed only on client instructions, with clear controls over how it is accessed, used and retained.
- Data Processing Agreement included in every client contract
- Ohpen acts as Data Processor, clients remain Data Controllers
- Anonymised or synthetic data used in non-production environments
- Automated deletion supports defined GDPR retention periods
Built for resilience
The platform runs across three AWS Availability Zones in Ireland, with automatic scaling and recovery. Hourly database backups are replicated to Frankfurt, supported by annually tested continuity and recovery plans.
- 99.9% uptime SLA for Savings and Investments, 99.8% for Mortgages
- <5-minute RTO and RPO for Availability Zone outages
- 4-hour resolution target for critical P1 incidents
- Controlled releases designed to minimise service disruption
- Contractual safeguards supporting service continuity
Full transparency
Ohpen provides clear communication around incidents and platform changes, with client interactions tracked through CCDESK for a complete audit trail.
- Major security incidents reported in line with agreed requirements
- Root Cause Analysis shared following confirmed security incidents
- Deployment calendars shared in advance with defined approvals
- Contractual audit rights for clients and regulators
Trusted dependencies
Third-party providers are assessed and monitored through Ohpen’s vendor management framework, with oversight based on their role, risk and criticality to our services.
- Risk and criticality determine the level of oversight applied
- Provider performance and risk are reviewed throughout the relationship
- Critical dependencies are incorporated into resilience and continuity planning
Cloud infrastructure provider
“ Security in financial services is ultimately about trust, between us, our clients and their customers. At Ohpen, security is not a department that sits apart from the product; it is embedded in how we build, how we release and how we respond.”
Acting responsibly beyond the platform
Our Sustainability Policy sets out our commitments to environmental responsibility, social impact and ethical governance. Guided by recognised frameworks, we focus on responsible business practices and understanding and reducing our environmental impact.
- Monitoring emissions to reduce our environmental footprint
- Promoting sustainable practices across our operations
- Reducing the environmental impact of digital activities and AI
Get in Touch
Contact Security
Have a security question?
For questions about our security, controls or assurance, or to report a potential security issue, get in touch with our Security team.