By Darwin Palma, Lead Data Engineer at Vizorfin
When a fund manager buys a new software platform, they usually focus on the features: Does it have automated NAV calculation? Can it generate Form PF?
They rarely focus on the underlying infrastructure.
But in 2026, with regulators in the US, UK, and Australia increasing their scrutiny of third-party risk, your software vendor is now an extension of your compliance perimeter. If they have a data breach, you have a regulatory problem.
Here are the 5 critical questions you must ask any FinTech vendor before signing a contract.
1. “Where is our data physically stored?”
This is the data residency question. If you have investors in the EU, their data cannot simply be stored on a server in the US without violating GDPR.
Ask the vendor: Can you guarantee logical data segregation by region? If they use a modern cloud architecture (like AWS, GCP, or Azure), they should be able to pin your data to specific geographic regions to comply with data sovereignty laws.
2. “Do you have SOC 2 Type II or ISO 27001?”
These are the gold standards for security. SOC 2 Type II means an independent auditor has verified their security controls over a period of time (usually 6-12 months). ISO 27001 is the international equivalent.
If a vendor says “we take security very seriously” but cannot produce a SOC 2 report, walk away.
3. “How do you handle data deletion?”
Regulators (and your investors) expect that if a fund closes or an investor leaves, their data can be permanently deleted.
Ask: After the analysis is complete, is the data retained? If so, for how long? Can we request immediate deletion?
A compliant vendor will have an automated deletion policy. Files should not be sitting in a staging environment indefinitely.
4. “Do you use our data to train your AI models?”
This is the newest and most dangerous question. If a vendor uses your proprietary fund data to train their public AI models, you have a massive data leakage risk.
Ask for a contractual guarantee that your data is logically isolated and never used to train foundational models.
5. “What is your incident response plan?”
It’s not a matter of if an incident happens, but when.
Ask: If there is a breach, what is your SLA for notifying us? Under GDPR, notification must happen within 72 hours. Your vendor must have a documented, tested incident response plan that aligns with your regulatory obligations.
The “Shadow IT” Risk
Remember that the biggest security risk often isn’t the vendor—it’s your own team bypassing the vendor. If your operations team finds the platform too complex, they will revert to using personal Google Sheets or Dropbox, creating massive unmonitored data leaks.
The best security strategy is to provide a platform that is both secure and easy to use, so the team actually uses it.
Where Vizorfin Fits
Vizorfin is built with compliance-first architecture. We enforce strict access controls, encrypt data at rest and in transit, and automatically delete files post-analysis. We are happy to share our security documentation with prospective clients.
Important: Vizorfin is a financial technology company. We are not a registered investment adviser, broker-dealer, or financial services licensee in any jurisdiction. Our software is a decision-support tool and should not be the sole basis for financial or compliance decisions. Individual results will vary. Consult with qualified financial, legal, and tax professionals.
Risk Warning: The use of AI-powered financial automation tools involves risks. No specific financial outcome is guaranteed. You should not rely solely on automated systems for financial decision-making.
If you’d like to review our security architecture, [contact us].