Security and regulation

Supervision and register entries

The account information service (AISP) is provided by Fizen Sp. z o.o., a provider of account information services only, entered in the KNF register (no. AISP13/2022).

The payment initiation service (PISP) is provided by Meest Transfer Sp. z o.o., a licensed payment service provider entered in the KNF register under no. AKPP/27/2024 and supervised by the Polish Financial Supervision Authority.

• Account information (AIS): Fizen Sp. z o.o., no. AISP13/2022
• Payment initiation (PIS): Meest Transfer Sp. z o.o., no. AKPP/27/2024

PSD2 and data access rules

• Consent: account access is possible only after the account holder's explicit consent, confirmed with strong authentication in their bank.
• Purpose: we process data only for the purpose the user agreed to and never use it for anything else.
• Duration: AIS consent lasts 180 days and then has to be renewed in the bank.
• Revocation: the user can revoke consent at any time in the Fizen consent dashboard, in the app they use, or in their bank.
• Credentials: we never see or store online banking logins or passwords. Login always happens on the bank's side.
• Channel: we use only the banks' official APIs, with no screen scraping.

Fizen for AI assistants

• You create the account by signing in with Google. Fizen never sees your bank or Google password.
• Each AI app sees only the accounts you share with it. Change or disconnect apps and their accounts at any time in your Fizen account.
• The assistant only reads data. It cannot prepare or make a transfer; you make transfers yourself in your own bank.
• Every sign-in, consent and assistant query is in the history of events in your Fizen account.
• When you delete the account we delete it, its accounts, consents, copies of bank data and AI app access; the history of events stays for the required period, without your email address.

GDPR

• Controller: Fizen Sp. z o.o., ul. Narutowicza 40/1, 90-135 Łódź, Poland. Data protection contact: [email protected].
• Legal basis: we fetch bank data only within your consent to account information access, given in your bank, for up to 180 days. We keep the history of events under Art. 6(1)(c) and (f) GDPR: proof of consent (Art. 18 of the Polish Payment Services Act), security of systems (DORA) and defence against claims.
• Recipients: banks we fetch data from on your instruction, apps you share data with (the company whose app you use, or an AI assistant), and Google Cloud as the infrastructure provider.
• Retention: the copy of bank data covers the history the bank made available and is deleted if it has not been refreshed for 30 days; removing a bank deletes it at once. History of events: 5 years (AIS Terms § 14), AI assistant query parameters 90 days.
• Rights: access, rectification, erasure, restriction, portability, objection and a complaint to the President of the UODO (Polish data protection authority).

DORA and operational resilience

• ICT risk register and a risk management framework in line with the DORA regulation.
• Classification and reporting of major ICT incidents to the KNF within the required deadlines.
• Annual penetration tests and regular resilience testing.
• A register of contracts with third-party ICT providers and assessment of their risk.

Technical security

• Encryption of data in transit (TLS 1.2 and higher) and at rest.
• eIDAS QWAC certificate for communication with banks.
• Servers in Poland or the European Economic Area; the Fizen account and the service for AI assistants run on Google Cloud in Warsaw (region europe-central2).
• Only authorised system administrators have access to databases with personal data.
• History of events (audit logs): 5 years, as § 14 of the AIS Terms says; assistant query parameters are deleted after 90 days and IP addresses older than 2 years are cut to the network address.

Professional indemnity insurance

Fizen holds the professional indemnity insurance required of account information service providers.

How to report a vulnerability

If you find a vulnerability in Fizen services, email [email protected]. Describe the issue and the steps to reproduce it. We take no legal action against anyone reporting vulnerabilities in good faith.