Industries
Banking and fintech
Money software is a control system that happens to have a screen. IncogX builds customer and operational journeys with authentication, a trail, and a clear split between who proposes and who approves. Client names are not published.
In brief, then in detail
- The journey and the control. Onboarding, payments support, servicing, or internal operations. Every step that moves money or identity has an owner and an evidence trail.
- Authentication. Including biometrics where the risk and the device justify it, with a fallback a real customer can complete.
- Separation of duties. The person who requests is not silently the person who approves. Privileged access is limited and reviewed.
- No borrowed badges. Payment-card and banking duties are assessed for the engagement. IncogX does not print a compliance certification it has not been given.
How it is run
Discovery names the risk events: fraud, failed authentication, a reconciliation break, an outage at month end. Architecture places those controls before the first customer sprint. Testing includes the unhappy paths. A public pattern from this work is mobile banking with biometric authentication. The institution is not named.
ExampleMobile banking, biometric sign-in
EvidenceWho acted, and who approved
ScopeControls designed per engagement
Controls that matter here
- Authentication
- Biometrics
- Audit log
- Separation of duties
- Reconciliation
- Privileged access
Terms, in plain language
- Separation of duties. No single person can both create and approve a sensitive action. It is how honest mistakes and abuse are both made harder.
- Reconciliation. Proof that two records of the same money still agree, and a path for when they do not.
- Privileged access. The few accounts that can change production or see broadly. They are named, limited, and reviewed.
- Fallback. The path when biometrics fail, a device is lost, or a customer cannot use the primary method. Designed, not improvised.