For banks & fintechs

Who can reach your customers' data — and can you prove it?

Global X Solutions reviews how data moves through your apps, vendors, agents and SaaS tools, and hands you an evidence-based report with a prioritised fix list.

Request a scoping call How it works

01 — Approach

Evidence first. Opinions second.

Every finding in our reports points to something you can check yourself: a configuration, a permission grant, a manifest entry, a network call. Where we cannot verify something, the report says so.

Our wording is aware of GDPR and DORA expectations around data protection, ICT third-party risk and documentation. We do not issue legal opinions or certifications; the report is input for your compliance, security and legal teams.

02 — How it works

Four steps, each agreed in writing

  1. Scope

    We agree which apps, systems, vendors and data flows are in scope, and what access we need — read-only wherever possible.

  2. Review

    We map data access, permissions and third-party flows against your own policies and the applicable requirements you name.

  3. Report

    You receive findings with evidence, risk rating and a prioritised fix list your teams can act on.

  4. Verify

    After fixes, we re-check the agreed items and document what changed.

03 — Privacy & data-access audits

Map who and what touches customer data

We trace access paths to personal and financial data: internal roles, service accounts, vendors and integrations. You see where access exceeds purpose, where logs are missing, and where data leaves your perimeter.

  • Access inventory and least-privilege gaps
  • Third-party and sub-processor data flows
  • Retention and deletion checks against your stated policy
  • Documentation useful for GDPR records and DORA ICT third-party registers

04 — iOS app privacy audits

Your App Store label should match your binary

We compare what your iOS app declares with what it actually does, including the SDKs bundled inside it.

  • Privacy manifests (PrivacyInfo.xcprivacy) for the app and third-party SDKs
  • Required-reason API declarations
  • App Store privacy ("nutrition") labels vs. observed data collection
  • Tracking domains and SDK network behaviour

05 — Agent & SaaS permission reviews

Automations hold keys too

Bots, automation agents and SaaS integrations often receive broad OAuth scopes and API tokens that nobody revisits. We list what each one can read and write, and what it should be able to.

  • OAuth scopes, API tokens and service-account rights
  • Over-privileged and unused integrations
  • Offboarding and revocation gaps

06 — Ongoing monitoring

Keep the picture current

Apps ship, vendors change, permissions drift. Ongoing monitoring repeats agreed checks on a schedule and flags changes against your last baseline.

Pricing: on request.

Why an EU-based partner

Why an EU-based partner

  • EU-based (Polish) company. Client data stays in the EU.
  • DORA ICT third-party documentation. We help you prepare the information banks need about ICT providers, data locations and data flows.
  • NIS2 / KSC supply-chain requirements. Poland's amended National Cybersecurity System Act (KSC) has been in force since 3 April 2026; obligations for in-scope entities apply by 3 April 2027.
  • Evidence-based reviews of apps, SDKs, vendors and permissions.
  • Working hours that overlap with the EU and the US morning. English and Polish.

No certifications or clearances claimed.

07 — Data & privacy

How we handle your data during an engagement

The points below are our stated working principles, not a certification or a confirmation of regulatory compliance. Contract terms (including a data processing agreement where required) take precedence. [TO BE CONFIRMED LEGALLY]

Least access

We ask for the minimum access needed for the agreed scope, read-only by default, and time-limited. Production customer data is not required unless you explicitly decide otherwise. [TO BE CONFIRMED LEGALLY]

Minimisation & retention

After the audit is completed, we return all documentation and materials received from the client and securely delete our working copies within 30 days, confirmed in writing. We do not retain client audit data. We keep only what the law requires: the contract, invoices and related accounting records (generally 5 years from the end of the financial year, Polish Accounting Act art. 74; Tax Ordinance art. 86). [TO BE CONFIRMED LEGALLY]

No resale, no reuse

We do not sell, rent or reuse your data or findings, and we do not name you as a client without your written consent. [TO BE CONFIRMED LEGALLY]

Confidentiality

Engagements can be covered by an NDA and, where we process personal data on your behalf, a data processing agreement under GDPR Art. 28. [TO BE CONFIRMED LEGALLY]

Your rights (GDPR)

Individuals can request access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with a supervisory authority (in Poland: UODO). [TO BE CONFIRMED LEGALLY]

Transparency

Controller: Global X Solutions, KRS 0000646869. Data contact: office@globalx.pl. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations such as accounting and tax (Art. 6(1)(c)), and legitimate interest in handling correspondence and defending claims (Art. 6(1)(f)). Where we process personal data on a client's behalf, we act as processor under Art. 28 GDPR and return or delete it at the end of the services (Art. 28(3)(g)). [TO BE CONFIRMED LEGALLY]

This site uses privacy-friendly, cookieless aggregate analytics (Cloudflare Web Analytics); no cookies, no cross-site tracking, no personal profiles. No third-party fonts. The contact form opens your own e-mail client; nothing is sent to a server.

08 — Contact

Request a scoping call

Tell us what you want reviewed. We will reply with questions and a proposed scope.

E-mail: office@globalx.pl

The form opens your e-mail client — nothing is sent to a server.