Enterprise security
Reviewed and deployed inside regulated banks and insurers
Imona runs in production inside regulated banking and insurance environments. That means the questions on your security questionnaire have been answered before, under audit, by reviewers with the same obligations as yours.
Regulated environments where security review is complete
Yapı Kredi Bankası
Banking · 1,500 users · customer contact centre operations
Allianz Sigorta
Insurance · 5,000 users · agency network
İş Bankası
Banking · 200,000 users · national programme
Infrastructure
- Hosting
- Cloud-native on Amazon Web Services
- Architecture
- Multi-tenant, with logical tenant separation
- Platform generation
- Fully rebuilt in 2026 on a current architecture, not a maintained legacy codebase
- Intellectual property
- Owned 100% in-house. No licensed third-party engine underneath the platform.
- AWS regions available
- [NEEDS INPUT: list the AWS regions available for deployment, and which is the default]Unconfirmed
- Availability and recovery targets
- [NEEDS INPUT: contractual uptime target, RTO and RPO]Unconfirmed
Data residency and GDPR
- European entity
- A Netherlands BV is the contracting entity for European customers
- EU data residency
- [NEEDS INPUT: confirm EU data residency options — which region, whether data can be pinned to it contractually, and whether any processing occurs outside the EEA]Unconfirmed
- Role under GDPR
- Imona acts as processor for customer employee data; the customer remains controller. In channel and dealer deployments the controller for partner-staff identity is normally the partner.
- Data processing agreement
- [NEEDS INPUT: confirm that a standard DPA and sub-processor list are available on request]Unconfirmed
- Personal data scope
- The platform works from performance measures and organisational structure. It does not require customer or policyholder records to function, and in sales deployments it reads aggregate and per-employee metrics rather than end-customer data.
- Retention and deletion
- [NEEDS INPUT: confirm retention periods and the deletion process on contract termination]Unconfirmed
Access control and identity
- Role-based access
- Employee, team leader and administrator roles with scoped visibility. Individual performance visibility can be restricted to the employee and their direct leader.
- Single sign-on
- [NEEDS INPUT: confirm supported SSO standards — SAML 2.0, OIDC — and whether SCIM provisioning is available]Unconfirmed
- Identity without work email
- Participants can be provisioned against an employee identifier from your workforce system where a work email address does not exist, which is the normal case for deskless retail and dealer staff.
- Administrator audit trail
- [NEEDS INPUT: confirm audit logging scope and log retention period]Unconfirmed
Certifications and assurance
- Regulated-environment review
- The platform has passed the information-security review of a regulated bank and a regulated insurance group in production deployments.
- ISO 27001
- [NEEDS INPUT: state the current ISO 27001 position — certified, in progress, or not held. Do not publish this page asserting a certification that is not held.]Unconfirmed
- SOC 2
- [NEEDS INPUT: state the current SOC 2 position]Unconfirmed
- Penetration testing
- [NEEDS INPUT: confirm penetration test cadence and whether a summary report is available under NDA]Unconfirmed
Works councils and employee representation
- Individual ranking
- Public individual leaderboards can be disabled entirely. The common European configuration is team, store or agency standing shown publicly with individual progress visible only to the employee and their direct leader.
- Location tracking
- Not required for the platform to function and not enabled by default. Visit completion can be driven by the CRM or calendar record employees already create.
- Performance data and employment decisions
- The configuration decision of whether programme data feeds formal performance management is the customer's, and it is the decision works councils care most about. It should be settled before launch rather than after.
Questionnaire, DPA or architecture review
Send the questionnaire you already use. We answer it as it is rather than asking you to accept a summary document.
Next step
Security questionnaire or architecture review
Send the questionnaire you already use. We answer it as it is rather than asking you to accept a summary document.
- We use your metric names and your org structure, not a generic demo tenant
- You see the level map, the mission board and the mentor guidance for your workforce
- You get the security and integration answers in the same call, not in a follow-up
- 30 minutes. If it is not relevant in the first five, say so and we will stop.