Cloud governance for banks and fintech
Banking
Where does our data sit, and can we prove it? A bank's first question is where each data class lives. We answer per category: the named AWS region (Mumbai or Singapore today, because Bangladesh has no hyperscaler region on any major cloud), any category that must stay on a defined local path, and the controls that apply to it. Hybrid is allowed. The split is written down, not implied.
Access runs through named roles with no shared administrator login. Centralized logging, encryption with a named key owner, and an audit pack that names the region and the controls are delivered before cutover. Multi-account structures follow a standard landing-zone pattern such as AWS Control Tower or an equivalent.
In one engagement, a private bank moved digital-channel and analytics workloads into a multi-account landing zone, ran a FinOps pass and moved to a single monthly invoice. Cloud cost fell 38 percent against direct AWS billing. That figure is representative of TiCON engagements, not a quote. The cutover ran without user-visible downtime in the window agreed for it. Engagements are quoted in USD; other currencies are by contract.
- Pattern: landing zone, IAM, logging, encryption, named region, audit pack.
- Residency: name the region; keep categories that must stay on a defined local path.
- Frames to check with counsel: data-protection rules for personal data, financial-sector supervision for your licence, and cross-border transfer terms in the contract, all as applicable in your jurisdiction.
Fintech
Payments, wallets, card issuing and acquiring, and know-your-customer or fraud analytics put cardholder data in scope. The pattern is the bank landing zone plus a documented cardholder-data boundary: which systems may hold primary account numbers, how keys are managed and how logs are kept. PCI DSS is the card-industry standard that defines those controls. We build toward it. We are not certified against it, and no PCI DSS certificate is claimed.
No fintech-titled case study is published yet. The closest proof is the bank engagement above, which uses the same landing-zone and audit shape. Card limits, e-money thresholds and processor terms are not stated on this page; they belong to your licence and your processor.
- Check first: which systems touch card data, and whether a hosted payment page keeps them out of scope.
- Pattern: bank landing zone plus a documented cardholder-data boundary.
- Readiness: PCI DSS readiness work only. SOC 2 is likewise a readiness topic, not a report we hold.
The industry map rows for this sector
| Industry | Architecture pattern | Data-location stance | Published case study |
|---|---|---|---|
| Banking | Landing zone, IAM, logging, encryption, audit pack | Named region; defined local path where categories must stay | Private bank: AWS costs cut 38% |
| Fintech | Bank landing zone plus a cardholder-data boundary. No PCI DSS certificate claimed | Same as banking; card data called out explicitly | None under a fintech title; nearest is the bank write-up |
Case studies name their clients. For banking, the client is United Commercial Bank (UCB), and the figure is representative, not a guarantee.
Frequently asked questions
Do you provide cloud for banks?
Yes. The pattern is an AWS landing zone, IAM, logging, encryption, a named region and an audit pack. The published case is United Commercial Bank (UCB).
Do you hold a PCI DSS certificate?
No. PCI DSS is a card-industry standard. We build to it and say so; we do not claim certification.
Do you serve fintech companies?
Yes, with the bank landing zone plus a cardholder-data boundary. We do not publish a fintech-titled case study yet.
Do you name the banks you have worked with?
Yes. United Commercial Bank (UCB) is named on its case study. Verify our AWS Partner listing, 0010h00001cA3jpAAC, at partners.amazonaws.com.
How do I check the data boundaries?
Ask for the data-location map per category, the identity model and the audit pack. Each region is written into the design before cutover, and any cross-border transfer is documented in the contract.
This page is not legal advice. Confirm the requirements that apply to you, as applicable in your jurisdiction, with your counsel and compliance team.