Finexio protects supplier payments with verification, bank-account validation, screening, payment monitoring, SOC 2 Type II reviewed controls for in-scope systems, J.P. Morgan payment infrastructure for supported workflows, and Finexio Shield coverage for eligible covered payments.
Finexio does not publish sensitive security artifacts as open web collateral. The review path gives qualified teams the right materials for the systems, workflows, and payment program being evaluated.
Share buyer, partner, program, and diligence context with sales so Finexio can qualify the request and route the right materials.
Sales qualification and routing
The SOC 2 Type II report (Schellman & Company, LLC; Security; April 1, 2025 to March 31, 2026) and supporting security materials are provided as appropriate, often under NDA.
Scoped materials
Finance, IT, security, and legal teams can review how controls apply to the intended payment program.
Control walkthrough
Data flow, file handling, supplier operations, status reporting, and escalation paths are resolved before launch.
Launch readiness
Buyers can review how controls attach to supplier setup, payment detail changes, release decisions, exception handling, and covered payment review. Final applicability depends on program scope and agreement terms.
Supplier details, ownership signals, payment preferences, and bank-account changes are reviewed before release.
Evidence buyers can review
Verification workflow and operations review
Where it applies
Before payment release
Bank-account changes are treated as high-risk events and routed through validation workflows before money moves.
Evidence buyers can review
Account-change controls
Where it applies
At setup and change events
Finexio supports KYC, OFAC, AML, and payee-risk review through screening and managed operations.
Evidence buyers can review
Screening and risk review
Where it applies
Before supported disbursement
Transactions are reviewed for unusual or risky behavior before release, when funds can still be protected.
Evidence buyers can review
Exception handling and review queues
Where it applies
Pre-release and exception states
Finexio's SOC 2 Type II examination was performed by Schellman & Company, LLC, covering controls relevant to Security for the period April 1, 2025 to March 31, 2026. The full report can be provided to qualified buyers and partners during sales-led diligence, subject to scope and access requirements.
Evidence buyers can review
SOC 2 Type II diligence path
Where it applies
For in-scope systems
Finexio Shield is a paid program that provides a $2M guarantee on covered payments. It is governed by its own program terms, eligibility, exclusions, and the applicable customer agreement.
Evidence buyers can review
Shield eligibility and program terms
Where it applies
After eligible covered issue review
These are the technical and operational controls Finexio runs across in-scope systems and the payment workflow. Scope and applicability are confirmed during diligence.
Customer and payment data is encrypted in transit and at rest.
Access to in-scope systems is role-based, limited to what each role needs, and reviewed.
Continuous scanning identifies issues, and remediation is tracked to closure.
Independent penetration tests run annually against in-scope systems.
Performed by Schellman & Company, LLC, covering controls relevant to Security for the period April 1, 2025 to March 31, 2026.
The release-gate controls on supplier identity, bank-account changes, payee risk, and transaction review live in the control matrix above.
The workflow is built for AP teams that need a clean handoff: buyer-approved payments in, managed payment delivery out, with control checks before release and operations support after.
Approved invoices or payment file leave the buyer-controlled workflow.
Payment data is received for orchestration, validation, routing, and status handling.
Payee, payment preference, bank-account, and risk signals are reviewed before release.
Supported payment workflows are routed across the appropriate rail and infrastructure.
Returns, reissues, statuses, remittance, and reconciliation are managed back to the buyer.
J.P. Morgan is the issuing bank behind card payments and provides payment infrastructure for supported workflows. Finexio is the orchestration platform that runs the operation, not a bank, and payment methods depend on program structure.
Finexio Shield is a paid program that provides a $2M guarantee on covered payments. It is governed by its own program terms, eligibility, exclusions, and the applicable customer agreement. Buyers should review coverage terms, exclusions, eligibility, operating procedures, and contractual requirements during diligence.
Shield is designed around pre-release controls such as supplier verification, bank-account review, screening, and payment monitoring.
Coverage applies only to eligible covered payments and depends on program terms, exclusions, customer agreement, and operating procedures.
If a covered issue is raised, Finexio reviews the payment record, control path, and program terms before any coverage determination.
Prospective security questionnaires, SOC 2 access, and data-flow reviews begin with Finexio sales. Potential vulnerabilities should use the support ticket path so the report is not treated like a sales or demo request.
Submit potential vulnerability reports through the Finexio support ticket path. Include enough context to reproduce the issue, but avoid sending sensitive account, supplier, or bank details in the first message.
Prospective SOC 2 requests, questionnaires, and data-flow reviews begin with sales. Potential vulnerabilities should use the support ticket path.
Include affected host, endpoint, steps, timestamps, screenshots where appropriate, and your preferred contact method. Do not test against production payment data.
Use this checklist to align finance, IT, security, legal, and implementation stakeholders before qualified diligence begins. It is built from the same control surfaces and request items used across this trust center.
Copy-ready checklist
Program context
- Confirm buyer, partner, program, and diligence owner context.
- Define AP payment scope, supported workflows, and intended payment rails.
- Identify customer systems, file transfer approach, and implementation timeline.
Evidence request
- Coordinate SOC 2 Type II scope and period through sales-led diligence.
- Prepare security questionnaire, data-flow, and implementation review questions.
- Confirm whether NDA, customer-specific access, or scope restrictions apply.
Payment controls
- Review supplier identity, bank-account validation, payee screening, and monitoring controls.
- Map controls to payment intake, release, exception handling, and reconciliation.
- Review Finexio Shield eligibility, exclusions, operating procedures, and agreement terms.A sales-led diligence conversation can cover control evidence, payment workflow review, supplier support, infrastructure qualifiers, and Shield questions in one place.
Availability of specific documents and walkthroughs depends on customer context, program scope, NDA status, and the systems or workflows being reviewed.
Trust request workflow
Eligible requesters
Prospective buyers and partners begin with Finexio sales when a real program evaluation is underway. Existing customers use a support ticket for account-specific needs.
Access and NDA
SOC 2 materials, questionnaires, DPA requests, and customer-specific artifacts may require NDA, scope confirmation, and named review owners.
Artifact menu
Common requests include SOC 2 review, security questionnaires, data-flow review, payment-control walkthroughs, supplier-support model, and Shield eligibility discussion.
Escalation paths
Prospective diligence begins with sales. Vulnerability reports, suspicious payment-change activity, incidents, and account-specific questions use the support ticket path.
Finexio's SOC 2 Type II examination was performed by Schellman & Company, LLC, covering controls relevant to Security for the period April 1, 2025 to March 31, 2026. Prospective buyers and partners begin with Finexio sales; report access and any NDA requirements are handled during qualified diligence.
Finexio can support security questionnaires, SOC 2 Type II review, payment-control walkthroughs, implementation data-flow review, supplier-support diligence, and Finexio Shield eligibility discussion.
Potential vulnerability reports should use the Finexio support ticket path. Prospective security diligence begins with Finexio sales.
J.P. Morgan is the issuing bank behind card payments and provides payment infrastructure for supported workflows. Finexio is the orchestration platform that runs the operation, not a bank, and payment methods depend on program structure.
Controls are applied in the payment workflow between buyer-approved payment intake and payment release, including supplier verification, bank-account validation, payee screening, monitoring, exception handling, and reconciliation support.
Finexio Shield is a paid program that provides a $2M guarantee on covered payments. It is governed by its own program terms, eligibility, exclusions, and the applicable customer agreement. Buyers should review coverage details during security and legal diligence.
No. Security, compliance, supported payment methods, payment infrastructure, coverage, and implementation details depend on program scope, payment eligibility, supplier data, and agreement terms.
Security, compliance, payment coverage, and implementation details depend on program scope, contractual terms, payment eligibility, customer data, and approved operating procedures. Finexio confirms the applicable controls and coverage during diligence.