Financial services
AWS for Fintechs, Credit Unions and Lenders in Colombia
For a financial company, an outage is not just a bad day: it is customers who cannot pay and a regulator asking questions. CloudTing designs and runs AWS infrastructure that keeps working if a zone fails, keeps evidence of who did what, and keeps your customers’ data encrypted.
What we solve
- High availability across two AWS zones, so one failing zone does not stop payments or queries
- Customer data and backups encrypted with your own keys in AWS KMS
- Secrets and credentials out of the code, in AWS Secrets Manager
- Audit evidence: AWS CloudTrail records who did what and AWS Config keeps the change history
- Audit logs in a separate account, locked against deletion (S3 Object Lock)
- Disaster recovery with RPO and RTO that are defined and tested, not just written down
Who it is for
- Fintechs that grew fast and never sorted out access, encryption or backups
- Credit unions and employee funds that want to move off their own server
- Lenders and collection companies that handle customers’ financial data
- Entities supervised by Colombia’s Financial Superintendence that need technical evidence for audits
What Colombian rules require
- Law 1266 of 2008 governs financial habeas data: your customers’ credit and financial data has its own rules, on top of Law 1581 of 2012 on personal data.
- The Financial Superintendence (SFC) set rules for cloud computing use by the entities it supervises (External Circular 005 of 2019, Chapter VI, Title I, Part I of the Basic Legal Circular).
- The same Superintendence set minimum requirements for managing cybersecurity risk (External Circular 007 of 2018, Chapter V, Title IV, Part I of the Basic Legal Circular).
- Law 1581 limits sending personal data to countries without an adequate level of protection. The SIC published the list of adequate countries, which includes the United States and Mexico.
What we do not do
We do not give legal advice or certify compliance. We put the technical controls in place and leave the evidence (logs, configurations, recovery tests) so your compliance officer, statutory auditor or external auditor can validate what applies to your entity.
Reference architecture
A typical pattern for a financial platform: the application runs across two Availability Zones with RDS Multi-AZ, everything is encrypted with KMS, secrets live in Secrets Manager, CloudTrail and Config leave the evidence an audit asks for, and backups and logs go to an isolated account where nobody can delete them.
How we start
- 1Free review: availability, access, encryption, backups and what evidence exists today
- 2Report with prioritized risks and a proposed AWS architecture
- 3Migration or changes in stages, without stopping operations
- 4A real recovery test, with RPO and RTO measured
- 5Ongoing operation and support, if you need it
Frequently asked questions
Can an entity supervised by the SFC use AWS?
Yes. The SFC regulated cloud use in External Circular 005 of 2019 instead of banning it. The entity must meet those rules; we handle the technical side and your compliance team validates the rest.
What happens if an AWS zone goes down?
The application runs in two Availability Zones and the database in Multi-AZ, with a standby in the other zone. If one zone fails, the other keeps serving. For bigger failures we define and test a recovery plan with measured RPO and RTO.
How do we show an auditor who did what?
AWS CloudTrail records every action in the account and AWS Config keeps the change history of every resource. Those logs are copied to a separate account locked against deletion, so nobody, not even an administrator, can alter them.
Do you certify compliance or give legal advice?
No. We are AWS consultants. We put the technical controls in place and deliver the evidence; the legal reading and certification come from your compliance team or an independent auditor.
Next step
AWS for Fintechs, Credit Unions and Lenders in Colombia