Security and compliance
Bolívar Connect is a payment orchestration platform operated by Coco: it receives payment instructions via API and passes them on to the regulated financial institution, which holds the funds and executes the payout. The platform does not receive, hold or transmit funds.
Balances shown to clients, such as a prefunded balance, are reference balances: they reflect each client’s position over the funds held in the bank accounts of the financial institution authorized in Venezuela to execute the payouts.
These are its security policies and procedures. Each document describes the controls the platform applies.
The Spanish version of these documents is the reference version; this English version is a faithful translation for convenience.
Documents
Section titled “Documents”| Code | Document | What it covers |
|---|---|---|
| D1 | Information security policy | Principles, roles, classification, cryptography, secrets, network, secure development, risks and reference frameworks |
| D2 | Access management | MFA, onboarding, offboarding, least privilege, client access and periodic review |
| D3 | Vulnerabilities and patching | Detection, classification, remediation deadlines, patching and penetration testing |
| D4 | Incident response | Severities, roles, phases, containment, communication and plan testing |
| D5 | Continuity, recovery and backups | RTO and RPO, scenarios, disaster recovery and backup policy |
| D6 | Data retention and deletion | Data inventory, retention periods, anonymization and data subject rights |
| D7 | Third parties | Third-party register, prior assessment, technical controls and follow-up |
Document control
Section titled “Document control”| Field | Value |
|---|---|
| Organization | Coco — Bolívar Connect platform |
| Version | 1.1 |
| Classification | Public — shared with clients and partners |
| Owner | Security Officer (Tech Lead) |
| Approval | Management |
| Review | Annual, or earlier upon a relevant change in architecture, third parties or regulation |
| Communication | All personnel with access to the platform know and accept them when joining |
Common definitions
Section titled “Common definitions”- Platform: the Bolívar Connect API, its database and the AWS infrastructure that supports it.
- Client or tenant: the company that integrates via API to send payment instructions.
- Regulated financial institution: the institution that holds the funds and executes the payout.
- Personnel: employees and contractors with access to the platform, its code or its infrastructure.
- Personal data: information that identifies a person, such as name, national ID (cédula), phone number, bank account, email or IP.