Protecting client data
Security and reliability
Client financial data is among the most sensitive a practice holds. Use this overview to start a discussion about access, hosting and data handling for your practice.
The controls
What protects the data, and where
Review access controls and discuss your practice's hosting and data-handling requirements during setup.
Getting in
Authentication is handled by a dedicated service, separate from the portals and from the services holding client data.
Key-protected API
Every HTTP endpoint is private and requires a stage-specific API key.
JWT authorisation
A Lambda authoriser validates the token on requests before any handler runs.
Hashed credentials
Passwords are hashed with bcrypt, never stored in readable form.
Revocable sessions
Tokens are revoked on logout so a signed-out session cannot be replayed.
Who can see what
Access follows the roles an advice practice actually has, rather than a single shared login.
Role-based access
Privileges separate account owner, adviser, paraplanner, research manager and admin.
Verified email and reset
Email verification and expiring password reset tokens for advisers and clients.
Where it runs
Discuss production hosting, environment separation and data handling with the team as part of your practice assessment.
Australian region hosting
Services run in AWS ap-southeast-2, the Sydney region.
Isolated environments
Separate development, QA, UAT and production stages with their own configuration.
Architecture
Twelve services, one boundary at the edge
Souffle runs as twelve independently deployable backend services on AWS Lambda and API Gateway in the ap-southeast-2 Sydney region. Every HTTP endpoint is private and requires a stage-specific API key, and a Lambda authoriser validates the JSON Web Token before any handler runs.
Uploaded files and images are held in dedicated S3 buckets per service and per stage, and local, development, QA, UAT and production each carry their own configuration — so a change can be proven before it reaches a practice.
Get started
See Souffle with your own practice in mind
Walk through client records, lead onboarding, workflow boards, modelling and the client portal with someone who knows Australian advice practices.