Security & Compliance
Trust is the product
Open banking only works when data is handled responsibly. Here’s how Silkroute does it.
Consent-first
Nothing is shared until the end user explicitly consents in the Link flow, which explains the data being shared under Uzbekistan’s Personal Data law (ЗРУ-547). Consent is time-boxed to 90 days (PSD2-style) and can be withdrawn.
Encryption
Bank OAuth tokens are encrypted at rest with pgp_sym_encrypt (AES). API secrets, link, public and access tokens are stored only as peppered SHA-256 hashes — plaintext is shown exactly once and never logged.
Tenant isolation
Every table is scoped by organization_id and every dashboard query is org-filtered. Automated tests prove one organization can never read another’s Items, accounts, transactions or payments.
Webhook integrity
Outbound webhooks are signed with HMAC-SHA256 over the exact delivered bytes (header Silkroute-Signature: sha256=…). User-supplied webhook URLs are checked against an SSRF allowlist that blocks private, loopback and link-local ranges.
Data minimisation
We store what the requested products need and no more. Access tokens and secrets are never exposed in the dashboard UI or in client bundles.
Operational safety
Payments run through a guarded state machine with idempotency and exactly-once settlement; a startup recovery job resumes any in-flight payment after a restart.
Regulatory context. Silkroute is built to align with the direction of the Central Bank of Uzbekistan on open banking and A2A payments, and with the Personal Data law (ЗРУ-547). Production connections are subject to a compliance and data-residency review — contact us.