Enterprise security
Reviewed and deployed inside regulated banks and insurers
Imona runs in production inside regulated banking and insurance environments. That means the questions on your security questionnaire have been answered before, under audit, by reviewers with the same obligations as yours.
Regulated environments where security review is complete
Yapı Kredi Bankası
Banking · 1,500 users · customer contact centre operations
Allianz Insurance
Insurance · 5,000 users · agency network
İş Bankası
Banking · 200,000 users · national programme
Infrastructure
- Hosting
- Cloud-native on Amazon Web Services
- Architecture
- Multi-tenant, with logical tenant separation
- Platform generation
- Fully rebuilt in 2026 on a current architecture, not a maintained legacy codebase
- Intellectual property
- Owned 100% in-house. No licensed third-party engine underneath the platform.
- AWS region
- Production runs in AWS eu-central-1 (Frankfurt). Availability zones are configured within Europe.
Data residency and GDPR
- European entity
- A Netherlands BV is the contracting entity for European customers
- EU data residency
- The production system is hosted in Frankfurt, Germany (AWS eu-central-1), inside the European Economic Area. The availability zones it uses are within Europe.
- Role under GDPR
- Imona acts as processor for customer employee data; the customer remains controller. In channel and dealer deployments the controller for partner-staff identity is normally the partner.
- Personal data scope
- The platform works from performance measures and organisational structure. It does not require customer or policyholder records to function, and in sales deployments it reads aggregate and per-employee metrics rather than end-customer data.
Access control and identity
- Role-based access
- Employee, team leader and administrator roles with scoped visibility. Individual performance visibility can be restricted to the employee and their direct leader.
- Identity without work email
- Participants can be provisioned against an employee identifier from your workforce system where a work email address does not exist, which is the normal case for deskless retail and dealer staff.
Certifications and assurance
- Regulated-environment review
- The platform has passed the information-security review of a regulated bank and a regulated insurance group in production deployments.
Works councils and employee representation
- Individual ranking
- Public individual leaderboards can be disabled entirely. The common European configuration is team, store or agency standing shown publicly with individual progress visible only to the employee and their direct leader.
- Location tracking
- Not required for the platform to function and not enabled by default. Visit completion can be driven by the CRM or calendar record employees already create.
- Performance data and employment decisions
- The configuration decision of whether programme data feeds formal performance management is the customer's, and it is the decision works councils care most about. It should be settled before launch rather than after.
Questionnaire, DPA or architecture review
Send the questionnaire you already use. We answer it as it is rather than asking you to accept a summary document.
Next step
Security questionnaire or architecture review
Send the questionnaire you already use. We answer it as it is rather than asking you to accept a summary document.
- We use your metric names and your org structure, not a generic demo tenant
- You see the level map, the mission board and the mentor guidance for your workforce
- You get the security and integration answers in the same call, not in a follow-up
- 30 minutes. If it is not relevant in the first five, say so and we will stop.