PROFILE Systems & Software SA

Lending Platform (Finuevo Suite)

Finuevo Suite is a cloud‑native, end‑to‑end smart banking platform combining robust core banking with advanced digital banking capabilities. Finuevo Suite enables public investment finance, managing loans and assets used for communities and municipal investment financing. Finuevo streamlines the credit institute’s lending and payment processes, ensure regulatory compliance,etc.

Features

• Real-time core banking operations with workflow automation.
• 24/7 browser-based access to information, actions, and services.
• API-driven open banking and PSD2 compliant integration layer.
• Cloud-enabled SaaS deployment with modular open architecture scalability.
• Mobile-first omnichannel digital banking across web and apps.
• Microservices cloud-ready architecture ensuring portability, stability, and scalability.
• Secure multi-device authentication for payments, accounts, transfers, and services.
• Automated client onboarding and seamless user journeys across channels.
• Natural-language analytics delivering tailored reports without predefined queries.
• AI-powered fraud detection, risk management, and automated workflows in real-time.

Benefits

• Accelerate product launches with configurable, componentized banking building blocks.
• Automate front-to-back processes using workflow-driven operations and templates.
• Provide 24/7 self-service banking through browser, mobile, and apps.
• Streamline customer onboarding with mobile-first omnichannel digital journeys.
• Integrate third-party systems quickly using open APIs and connectors.
• Improve decision-making by asking questions in natural language.
• Generate tailored reports instantly without predefined queries or complex SQL.
• Detect fraud attempts continuously with real-time analytics and alerts.
• Reduce operational effort by automating repetitive tasks across workflows.
• Lower total cost via SaaS cloud deployment and fast implementation.

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicps@profilesw.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

938884703000368

Contact

Aimilios Voudouris
+302109301200
publicps@profilesw.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Financial and Accounting Applications
  • Accounts Payable Applications
  • Accounts Receivable Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No constraints
• System requirements:
  • No specific external software licences is required
  • No specific anti-virus technology is required

User support

• Email or online ticketing support: Yes
• Support response times: Less that 1 hour 24/7
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: We have tested our web chat experience with assistive-technology users through moderated, task-based sessions and structured accessibility QA. Testing covered screen readers, keyboard-only navigation, screen magnification/high-contrast modes, and mobile accessibility features. Participants completed realistic journeys: launching chat, receiving new-message notifications, reading message history, composing/sending messages, using quick actions, attaching files, ending sessions, and accessing transcripts. We specifically validated focus management, tab order, visible focus, ARIA labels/roles, live-region announcements for incoming messages, error handling, and timeouts. Findings were logged, prioritised, and remediated; fixes were then re-tested with the same assistive-technology setups and included in regression checks to prevent recurrence.
• Onsite support: Yes, at extra cost
• Support levels: We provide three support levels.; Level 1 (Standard): Included in the SaaS subscription. Ticket-based support, incident management, standard SLAs, product updates guidance, and access to documentation.; Level 2 (Advanced): Additional cost. Faster response and resolution SLAs, extended coverage, proactive monitoring, release/change coordination, and priority escalation. Cost is an add-on to the annual subscription, quoted based on tenant count, environments, SLA targets, and coverage scope.; Level 3 (Premium/Enterprise): Highest additional cost. Highest-priority SLAs, proactive service reviews, major event/change support, and direct engineering escalation. Cost is a premium add-on, quoted based on criticality, coverage, and SLA commitments.; Technical Account Manager / Cloud Support Engineer: A dedicated Technical Account Manager (TAM) is included in Level 3 and available as an option in Level 2. A Cloud Support Engineer can also be assigned for onboarding, cloud operations support, and ongoing optimisation.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We provide onsite training, online training and user documentation based on client's demand
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The data is extracted in XML or any other structured form that is required
• End-of-contract process: After the end of the contract is not allowed to use the application except if the contract includes other terms
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No differences
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Every functionality in the application can be called by the API
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our applications are fully customized in every level (UI, Tasks, User environment)

Scaling

• Independence of resources: Via scalability of the resources and prioritization ques

Analytics

• Service usage metrics: Yes
• Metrics types: Via open telemetry and log files
• Reporting types:
  • API access
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Via functions in the menu of the application
• Data export formats:
  • CSV
  • ODF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.95% - 99.99% levels of availability in our SLAs. User refunded based on the signed SLA
• Approach to resilience: Available upon request
• Outage reporting: Via API or Email Alerts

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: We restrict access using role-based access control and least privilege, enforced with MFA/SSO. Administrative interfaces are limited by IP allowlists/VPN and audited. Support channels use authenticated users, tenant-scoped permissions, and case-based access; sensitive data is redacted and protected with encryption and logging.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: ISO 27001
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We use a controlled, auditable configuration and change management process for our SaaS services.; Every service component is uniquely versioned and recorded in source control and our release repository. Infrastructure and configuration are managed as code, so all changes are traceable. Builds produce immutable, signed artifacts stored in a central registry. Deployments are executed via CI/CD pipelines.; Each change is classified and risk-rated. Changes affecting authentication, authorization, encryption, logging, tenant isolation, or external interfaces trigger mandatory security review. Automated security checks run in the pipeline. High-risk findings block release until remediated or formally exceptioned with documented compensating controls and approvals.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We continuously assess threats via threat modelling, attack-surface reviews, and automated scanning of code, dependencies, containers, and cloud configurations. Issues are triaged by severity, exploitability, data exposure, and tenant impact, then tracked to closure. We patch via CI/CD: critical within 24–72 hours, high within 7 days, medium/low in the next release cycle; emergency mitigations are applied immediately when needed. Threat intelligence sources include vendor advisories, cloud security bulletins, dependency alerts, penetration tests, and customer reports.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use protective monitoring with centralized logging, SIEM alerting, and continuous anomaly detection across applications, APIs, identities, and cloud infrastructure. We identify potential compromises through correlation rules, suspicious access patterns, privilege changes, unusual data access, and threat indicators. When detected, we triage immediately, contain (isolate accounts/hosts, revoke tokens), preserve evidence, eradicate, and restore with validated rollbacks. We initiate incident response for high-severity alerts and provide continuous updates until closure.
• Incident management type: Supplier-defined controls
• Incident management approach: We follow a documented incident management process with pre-defined playbooks for common events (service degradation, security alerts, failed deployments, data issues). Users can report incidents via the support portal, email, or dedicated escalation channel included in their support level. We provide incident communications through ticket updates and, when needed, a broadcast notification. After closure, we issue an incident report including timeline, impact, root cause, corrective actions, and prevention measures, with optional review meeting for major incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: Greek

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 4%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NBIS P.C.C.
• ISO/IEC 27001 accreditation date: Friday 14 August 2020
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001 certification encompasses our entire information security management system, covering all aspects of our operations, including risk assessment, data protection, access controls, incident management, compliance, and continual improvement. We've implemented and certified the full set of controls relevant to our business to ensure comprehensive security for our software development, deployment, and support services.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: NBIS P.C.C.
• ISO 9001 accreditation date: Friday 14 August 2020
• What the ISO 9001 doesn’t cover: Our ISO 9001 certification covers our complete quality management system as a software house, addressing all key requirements including customer satisfaction, leadership commitment, process optimization, resource management, performance evaluation, and continual improvement. There are no exclusions. We've fully implemented and certified the standard across our operations to deliver high-quality software development, testing, delivery, and customer support services.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C2b6ff10-94b0-4ecb-881d-bc55711b6822
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • ISO/IEC 27701:2019
  • ISO 20000-1:2018
  • ISO 22301:2019
  • ISO/IEC 27017:2015

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicps@profilesw.com. Tell them what format you need. It will help if you say what assistive technology you use.