Security and Data Trust When Software Runs Your Operation

Before a business asks whether operations software works, it should ask a ruder question: what exactly are we handing over? The answer, for a manufacturer or distributor, is the order book — every customer, every supplier, every price, every margin. For a mortgage lender, it is something more sensitive still: borrowers' financial lives, in documents. Software that runs the operation holds all of it. Security, in this category, is not a feature on a checklist. It is the gate every other feature waits behind — and it should be stated plainly enough to be checked. Wynura states it in six points, SEC-01 through SEC-06. Here is what each one means in practice.

SEC-01 — Encrypted end to end

Your order book, supplier list and invoices are encrypted in transit and at rest — on the wire and on the disk, not one or the other. And the second half of the point matters as much as the first: data is never sold, never shared, and never used to train models for anyone else. An automation platform learns your operation in order to run it. The moment that learning leaks into a product improvement for your competitor, the platform has two customers and you are the product. SEC-01 draws the line in writing: your data works for you.

SEC-02 — Your data stays yours, and in your country

Choose United States or Canada data residency. For Canadian lenders handling borrower files — notices of assessment, income letters, property records — residency is not an abstraction; it is a question their borrowers' brokers and their own compliance instincts will ask, and "Canada" is an answer that ends the conversation. Ownership is the other half: export or delete everything at any time, and if you leave, your data leaves with you, intact. A platform confident in its value does not need to hold your records hostage.

SEC-03 — Strict access controls

Role-based access, least-privilege by default: people — and bots — see the minimum the job requires. Wrapped around it, a full audit log of every bot action: every chase email sent, every invoice matched, every change made is traceable to who or what did it. This is the control that makes automation governable. When a supplier asks why they received a third reminder, or a broker asks who saw a file, the answer is not a shrug and a forensic weekend. It is a line in a log.

SEC-04 — Built to a public standard

Controls aligned to SOC 2, with a public trust page, so your customers and your bank can check the posture instead of taking our word for it. The word "aligned" is doing honest work in that sentence, and it should: the claim is that the controls are built to the standard and published for inspection. For a small manufacturer whose largest customer sends a vendor-security questionnaire, or a MIC whose investors ask how borrower data is guarded, a checkable posture is worth more than a confident adjective.

SEC-05 — Suppliers get no login

The chase works over plain email. Your suppliers never create accounts or see a portal — and neither do a lender's brokers. Every account you issue to an outsider is a door into your data that must be guarded forever; email has no door. This is a security control disguised as a convenience feature, and it has a second benefit: it is the reason the data actually comes back. A supplier who must adopt your portal before confirming a delivery date adopts it never. A supplier who can reply to an email replies.

SEC-06 — Humans at the money points

Bots prepare, check and chase. A person approves payments and outbound prices. Automation never moves money on its own. This is the control that lets an owner sleep: the three-way match can clear a clean invoice and stop a variance, but the payment itself crosses a human desk. In the Lender Edition the same principle appears in its sharpest form — the stack prepares, chases and packages files, while approval and decline stay with the lender's underwriters, always. Speed is delegated. Judgment is not.

How the six points fit together

Read as a set, the six points describe a posture: encrypt the data (SEC-01), keep it yours and in your jurisdiction (SEC-02), restrict and log who touches it (SEC-03), build to a standard others can verify (SEC-04), minimise the doors (SEC-05), and keep a human on the money (SEC-06). Integrations — to your accounting, inventory and email systems, and to your CRM where you require one, arranged during the POC and deployment — are held inside the same controls: the stack connects to your tools; it does not scatter your record across them.

From six points to the frameworks

The six points are Wynura's own statement. Behind them sit the frameworks a customer's bank, borrowers or regulator will name — PIPEDA, CASL, OSFI Guideline E-23, SOC 2, ISO/IEC 27001 and 42001 — and Wynura's position under each is set out on the compliance page and in the companion article Compliance, in Plain Language. The wording there is as deliberate as it is here: alignment and design, claimed precisely — certification is not claimed, because Wynura holds none.

Checking, not believing

The invitation behind all six points is inspection. Ask the questions in the FAQ below of any operations platform — including, especially, the incumbent processes: the shared spreadsheet, the inbox where borrower PDFs live unencrypted, the portal logins handed out over the years and never revoked. The comparison is rarely between software risk and no risk. It is between stated, logged, checkable controls and the unaudited status quo. The 14-day proof of concept runs under the same six points as the full deployment, so the checking can start with the trial itself.