Sheet 01
Threat
A financial product holds both customers' identities and their money, so every layer is a target: account takeover, insider misuse, and transactions nobody can explain after the fact. Every control has to be provable, not promised.
Threat register
- T1 Account takeover Someone else signs in as the customer.
- T2 Insider misuse Staff use their access for something they shouldn't.
- T3 Unexplained transfers Money moves, and afterwards nobody can say why.
Sheet 02
Control
L1Identity and sign-in
- KYC at onboarding, wrapped in our own one-person-one-account checks Stops: T1
- Passkeys or an authenticator app to sign in Stops: T1
- A risk-based second check before money moves Stops: T1T3
L2Money movement
- Its own ledger for every movement Stops: T3
- Sanctions screening before money moves; if the check can't finish, the transfer stops Stops: T3
- Monitoring for eight laundering and collusion patterns, tuned in shadow mode first Stops: T3
L3Staff console
- A permission on every screen Stops: T2
- Sensitive changes need a fresh second factor and a second approver Stops: T2
- Every action in the audit log Stops: T2T3
L4The app on the phone
- Certificate pinning Stops: T1
- Rooted and jailbroken phones blocked Stops: T1
- Obfuscated release builds Stops: —General control
L5AI support assistant
- Answers from the platform's own help content, with sources shown Stops: —General control
- Reads only the signed-in customer's own data and can't move money Stops: —General control
In full
Identity first: KYC through a verification provider at onboarding, wrapped in our own one-person-one-account checks, keeping only the identity fields the app needs. Sign-in with passkeys or an authenticator app, and a risk-based second check before money moves. Money movement sits behind its own ledger. Every account that sends or receives funds is checked against sanctions lists before money moves; if the check can't complete, the transfer stops. An in-house monitoring engine watches for eight laundering and collusion patterns, running in shadow mode first so thresholds are tuned on real activity before anything is enforced. Staff work in a console where every screen needs a permission, sensitive changes need a fresh second factor and a second approver, and every action lands in the audit log. On the device: certificate pinning, rooted and jailbroken phone blocking, and obfuscated release builds. Customers get an AI support assistant that answers from the platform's own help content with sources shown, reads only the signed-in customer's own data, can't move money, and hands over to a person when it isn't sure.
Sheet 03
Outcome
Designed and built under our founder's hands-on lead, from the first line of code to a public beta on both app stores, in English and Thai. About 14,500 automated tests and 77% line coverage on the mobile app at the latest release, a threat model reviewed monthly, and a security review before every release. Customers can export, correct or delete their own data from an in-app privacy centre. The same security baseline now ships with every Keel North project.
Client names are withheld. More detail is available under NDA.
Sheet 04 · Redrawn exhibits
What was built, redrawn
The company is confidential, so these are new drawings, not screenshots. The structure is real; every name and number in them is sample data.
Start with a Blueprint.
Two to three weeks, a fixed build quote at the end, and every document is yours whether or not we build together.