Baasplus security: application controls, strong customer authentication and data residency

How our white-label banking architecture connects application security, customer authentication and the location of financial data.

By Dario Vanin, HKMSP

Disclosure: HKMSP develops and operates Baasplus and has a commercial interest in the platform.

At HKMSP, we build and operate Baasplus, a white-label banking platform connecting customer applications and back-office tools to banking and payment partners.

Security in this environment spans several boundaries. A customer needs secure access to their account. An employee needs permissions appropriate to their responsibilities. Each brand needs separation from other deployments. Information needs to be handled in locations consistent with the service’s obligations.

OWASP guidance, Strong Customer Authentication and data-residency requirements provide complementary ways to examine those boundaries.

Application security through an OWASP lens

Baasplus uses separate cloud projects, databases and secrets for each brand, alongside granular access controls and encrypted data and secrets. This creates distinct deployment boundaries while allowing brands to use a common software foundation. Baasplus architecture

OWASP helps explain why infrastructure separation is only one layer of application security. Within a brand’s environment, the application must also distinguish between customers, business users and operational roles.

For example, a customer’s ability to retrieve a statement must depend on their permission to access that statement. Possessing its identifier is insufficient. OWASP describes failures in this area as broken object-level authorisation: an API accepts a reference to a record without adequately checking whether the user may perform the requested action. OWASP API Security guidance

That risk is directly relevant to the accounts, cards and documents exposed through a banking application.

The OWASP Top 10 provides a shared vocabulary for discussing application risks. For more specific verification requirements, the OWASP Application Security Verification Standard provides a framework covering the design, development and testing of security controls. Referencing these resources should not be confused with certification or evidence that a particular deployment has passed an assessment. OWASP Top 10, OWASP ASVS

Strong Customer Authentication belongs in the payment journey

Baasplus provides managed authentication, multi-factor authentication and device-level biometric or PIN protection. These capabilities support customer access security. Baasplus authentication capabilities

Strong Customer Authentication, or SCA, has a more specific meaning in European payments. It requires at least two independent elements drawn from knowledge, possession and inherence: something the customer knows, possesses or is.

Where required for a remote electronic payment, authentication must also dynamically link the transaction to its amount and payee. Changing either must invalidate the authentication code. Applicable exemptions and the independence of the factors also matter. EU SCA technical requirements

For a Baasplus deployment, the complete journey therefore needs to be considered alongside the selected payment provider. Opening the app with a biometric or completing a multi-factor sign-in does not, by itself, establish that every subsequent payment meets SCA requirements.

The division of responsibilities between the application and provider matters: which party authenticates the customer, how transaction details are presented, and how approval is associated with the intended payment. These are deployment-specific requirements, rather than conclusions that can be drawn from an “MFA supported” feature description.

Data residency is an architectural decision

Baasplus’s published architecture places its infrastructure in a European Google Cloud region. Together with separate environments for each brand, this provides a foundation for discussing geographical requirements with customers. Baasplus infrastructure

An “EU data stays in the EU” commitment needs a precise scope. It should identify the actual EU hosting location and address databases, documents, backups, logs, disaster-recovery copies and third-party processing. A reference to “Europe” alone does not establish that every service or data flow remains inside the EU.

Operational access also matters. Hosting information in an EU region does not, on its own, answer questions about access from other countries or onward transfers through suppliers.

GDPR does not impose a blanket requirement that all EU personal data remain in the EU. Transfers outside the European Economic Area can be permitted through mechanisms such as adequacy decisions or appropriate safeguards. Contractual commitments and sector-specific requirements may impose additional restrictions. European Commission guidance on international transfers

For Baasplus, geographical requirements must therefore be addressed across the proposed deployment and its partners, with the agreed residency commitment stated explicitly.

Connecting architecture to operation

HKMSP designs, builds and operates Baasplus, with structured logging and monitored operations supporting the live platform. Baasplus operations

Our architectural foundation combines brand separation, controlled access and regional infrastructure. OWASP gives the application-security discussion structure; SCA defines specific payment-authentication requirements; residency commitments establish where information may be handled.

Bringing those elements together makes the security conversation concrete: which controls the platform provides, which responsibilities belong to financial-service partners, and what must be verified for the customer’s deployment.