◆ Sparround

Fintech practices: sessions, sensitive data, compliance

The daily engineering habits separating a banking app from an ordinary one:

Session management:

  • Short access tokens + refresh rotation; server-side session lists and remote revocation
  • Inactivity timeout — auto-lock on idleness (via a lifecycle observer)
  • Hiding sensitive screens when backgrounded; PIN/biometrics on return

The sensitive data lifecycle:

  • Never in logs: PAN, CVV, tokens, passwords, balances — a release log policy + lint rules
  • No PII in analytics/crash reports (audit Crashlytics custom keys)
  • Clipboard: ClipDescription.EXTRA_IS_SENSITIVE when copying card numbers, timed clearing
  • Masking in screenshots; choosing importantForAutofill/inputType against keyboard caches

Compliance thinking:

  • PCI DSS — card data: the mobile device counts as untrusted → no full PAN/CVV stored, tokenization
  • PSD2/SCA (Europe) — strong customer authentication: two factors, dynamic linking (amount+payee in the confirmation)
  • Audit trails — critical operations tracked server-side; an event journal on-device too
  • Pen-test and audit cycles — part of the release process
kotlin
class SessionGuard(
    private val lockScreen: () -> Unit
) : DefaultLifecycleObserver {

    private var backgroundedAt: Long = 0

    override fun onStop(owner: LifecycleOwner) {
        backgroundedAt = SystemClock.elapsedRealtime()
    }

    override fun onStart(owner: LifecycleOwner) {
        val away = SystemClock.elapsedRealtime() - backgroundedAt
        if (backgroundedAt > 0 && away > LOCK_AFTER_MS) {
            lockScreen()               // PIN/biometrika ekranı
        }
    }

    companion object { const val LOCK_AFTER_MS = 60_000L }
}

// Kart nömrəsinin təhlükəsiz kopyalanması
fun copyCardNumber(context: Context, masked: String) {
    val clip = ClipData.newPlainText("card", masked).apply {
        description.extras = PersistableBundle().apply {
            putBoolean(ClipDescription.EXTRA_IS_SENSITIVE, true)  // önizləmədə gizli
        }
    }
    context.getSystemService<ClipboardManager>()?.setPrimaryClip(clip)
}

Session locking: inactivity + backgrounding

Sentences that signal fintech thinking in interviews: "We never trust the client — limit checks in the UI are convenience, on the server they are law"; "Every critical operation carries an idempotency key — network retries cannot double-charge"; "Feature flags roll risky functionality out gradually"; "Pre-release security checklist: log audit, screenshot test, backup verification". Detail at this level ties technical knowledge to business risk — the most valued skill in a banking interview.

🛠 Practice task

Run a mini audit on your own (or a sample) app:

  • Grep the Log calls: are tokens, cards or balances logged? Disable/redact logging in release.
  • Add a session lock: a PIN screen after 60 seconds in the background.
  • Copy a card number with EXTRA_IS_SENSITIVE and inspect the clipboard preview.
  • Review your Crashlytics custom keys — any PII?

Done when: you have a 5-item findings list with a fix noted for each.

📚 Sources and documentation