What to Ask Your Vietnam Financial Data Vendor About Security

On this page

• Why is data vendor security suddenly a boardroom issue?
• What does data vendor security actually cover?
• Five data vendor security questions to ask before you buy
• How does Vietnam's Personal Data Protection Law change the picture?
• What does strong data vendor security look like in practice?
• A data vendor security checklist you can reuse
• Frequently asked questions
• Sources

Why is data vendor security suddenly a boardroom issue?

For years, Vietnamese banks, brokerages, and funds treated a market-data feed the way they treat plumbing: something that either works or does not, and rarely a topic for the risk committee. That view is now dangerous. Data vendor security has moved from an IT footnote to a boardroom risk, because the supplier that streams your prices or verifies your customers sits inside your trust boundary. If an attacker compromises that supplier, they inherit a path straight into your systems.

The wake-up call came in June 2026. Security reporting linked the OceanLotus group, a Vietnam-focused actor also tracked as APT32, to an intrusion that used the SPECTRALVIPER backdoor and reached users of the FireAnt trading application, according to The Hacker News (June 2026). SPECTRALVIPER itself is not new: Elastic Security Labs first documented the backdoor on June 9, 2023, when it was deployed against large public companies operating inside Vietnam. We covered the mechanics in our analysis of the FireAnt MetaKit attack.

The common thread is the supply-chain attack. Rather than breaking through your firewall, the attacker compromises a supplier you already trust, then rides that trust inward. When the supplier is a financial data vendor, the blast radius can include trading positions, client records, and identity documents. This is the same logic behind the ransomware campaigns we tracked in Vietnam's SME ransomware wave and the agentic malware in the JadePuffer case. It is why data vendor security now deserves the scrutiny you would give a core banking upgrade.

What does data vendor security actually cover?

Data vendor security is the full set of controls a supplier uses to protect the confidentiality, integrity, and availability of the data it handles on your behalf. It is easiest to reason about in five layers you should be able to name from memory: where your data lives (residency and hosting), how it is protected (encryption and key management), who can touch it (access control and insider risk), how the vendor proves any of this (certifications and audits), and what happens when something breaks (incident response and breach notification).

Two acronyms recur in every serious conversation. ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS): the documented, organization-wide way a company identifies, treats, and reviews security risk. Its 2022 revision defines management requirements in Clauses 4 to 10 and lists 93 controls in Annex A, per the International Organization for Standardization (ISO). SOC 2 (System and Organization Controls 2) is an audit framework from the American Institute of Certified Public Accountants (AICPA) that reports on a service organization's controls against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Neither is a rubber stamp, yet both force a vendor to write down and test their controls instead of merely asserting them.

A third term matters in Vietnam specifically: eKYC (electronic Know Your Customer), the remote identity-verification step that brokerages and banks run before opening an account. eKYC data (a face scan, an identity card, a liveness check) is among the most sensitive information a vendor can hold, so it raises the bar higher still. A vendor that handles eKYC on your behalf should be able to describe every one of the five layers above without reaching for a sales deck.

Five data vendor security questions to ask before you buy

Use the five questions below as a scorecard. For each one, a strong vendor gives a specific, documented answer, not a marketing slogan. Vague, defensive, or "trust us" replies are themselves a data vendor security signal, and usually a bad one. Score each answer, and treat any blank as a red flag worth escalating.

1. Where is my data stored, and does it meet Vietnam data residency rules?

Ask for the physical location of every system that stores or processes your data, including backups and disaster-recovery sites. Vietnam's Law on Cybersecurity and its data-localization guidance push certain categories of data about Vietnamese users to be stored inside the country. A vendor that cannot tell you which data center holds your records, or that quietly mirrors data to servers abroad, is a data vendor security problem and a legal exposure at the same time. We unpack the legal side in our guide to Vietnam's data laws and foreign SaaS risk.

2. How is my data encrypted, in transit and at rest?

Encryption in transit (typically Transport Layer Security, TLS 1.2 or 1.3) protects data moving between you and the vendor. Encryption at rest protects it while it sits in storage. Ask which algorithms they use, who holds and rotates the keys, and whether you can bring or hold your own key. Ask what happens to encryption if you terminate the contract. If a vendor cannot answer these plainly, its security posture is unproven, no matter how polished the dashboard looks.

3. What certifications back your data vendor security claims?

Ask for a current ISO/IEC 27001 certificate and a recent SOC 2 Type II report, then read the scope carefully. A certificate that covers only a marketing website, and not the data platform you are actually buying, is close to worthless. SOC 2 Type II matters more than Type I because it tests whether controls operated effectively over a period, usually 6 to 12 months, rather than at a single moment. Request the full report under a non-disclosure agreement (NDA) and read the auditor's list of exceptions, which is where the real story of a vendor's security posture lives.

4. How do you handle access control and insider risk?

Most breaches involve a person, so ask how the vendor limits who can see your data. Look for role-based access control (RBAC), multi-factor authentication (MFA), least-privilege defaults, and logging of every access to sensitive records. Ask how fast access is revoked when an employee leaves, whether privileged actions are reviewed by a second person, and how third-party tools are vetted. Strong data vendor security assumes insiders can make mistakes or turn malicious, an assumption reinforced by the tool-supply-chain worries we covered in the Claude Code backdoor debate.

5. What is your incident response and breach notification process?

No vendor is breach-proof, so the real test is what happens next. Ask to see the written incident-response plan, the maximum time the vendor commits to notifying you after a confirmed breach, and concrete examples of past incidents and how they were resolved. Under Vietnam's tightening rules, notification windows are shrinking, so a vendor that will commit in writing to telling you within 72 hours is demonstrating a mature security posture. Silence, or a promise to notify "as appropriate", is a warning.

How does Vietnam's Personal Data Protection Law change the picture?

Vietnam has moved quickly on data rules, and each step raises the stakes for data vendor security. Decree 13/2023/ND-CP, the Personal Data Protection Decree (PDPD), took effect on July 1, 2023 as the country's first broad personal-data rulebook, introducing consent requirements, data-subject rights, and impact-assessment duties, as summarized by Vietnam Briefing.

The bar rose again with the Law on Personal Data Protection (Law No. 91/2025/QH15), which takes effect on July 1, 2026 and replaces the interim decree, according to Vietnam Briefing and the law firm Tilleke & Gibbins. It is Vietnam's first full statute dedicated to personal data, carrying heavier penalties and clearer obligations for anyone who processes personal data, your vendors included. The direction of travel matches the credit-risk and compliance pressure we described in our review of Vietnam banking in H1 2026.

For buyers, the takeaway is blunt: your data vendor security due diligence is now partly a legal duty, not just good hygiene. If a vendor mishandles Vietnamese personal data, the liability can land on you as the data controller. Writing specific security and privacy terms into the contract, with audit rights, sub-processor disclosure, and breach-notification clauses, is how you push that risk back onto the party best able to manage it.

What does strong data vendor security look like in practice?

Strong data vendor security is boring in the best possible way: documented, tested, and easy to explain under pressure. A mature vendor will volunteer its ISO/IEC 27001 certificate, share a scoped SOC 2 Type II report under NDA, name its data-center locations, and walk you through its incident-response runbook without flinching or filibustering.

• Green flags: named data-residency locations, current ISO/IEC 27001 and SOC 2 Type II with in-scope platforms, encryption at rest and in transit with clear key ownership, RBAC plus MFA, a written 72-hour breach-notification commitment, and contract terms that grant you audit rights.
• Red flags: "our cloud provider handles security", certificates that expired or cover the wrong system, no answer on key management, shared admin logins, no incident-response plan, and reluctance to put any of it in writing.

DataCore built its platform around exactly these expectations. Our eKYC Service, Company Intelligence Service, and Address Service run on infrastructure designed for Vietnamese data-residency and audit requirements, so your data vendor security review starts from a documented baseline rather than a blank page. When you ask us the five questions above, you get specifics, not slogans.

A data vendor security checklist you can reuse

The five questions map cleanly onto a one-page checklist you can paste into a procurement template and reuse at every renewal. Each row pairs the question with what a genuinely strong answer includes and the standard or law it lines up against. Print it, score each vendor from zero to two on every row, and let the total drive the conversation. A vendor that scores full marks has made security a habit rather than a sales talking point.

Who actually needs this discipline? Any Vietnamese institution whose decisions ride on outside data: a securities firm pulling live prices, a bank running remote onboarding, a fund screening counterparties, or a lender pricing risk from third-party company records. The more decisions you automate on top of vendor data, the larger the damage when that data is tampered with or leaked, and the more a rigorous data vendor security review pays for itself.

It also helps to price the downside. A single confirmed breach can trigger regulator scrutiny under the new law, client attrition, forensic and legal costs, and days of trading disruption while systems are rebuilt and verified. Set against those numbers, the hours spent on a proper data vendor security review before signing are among the cheapest risk controls a finance team can buy. The goal is not zero risk, which no vendor can promise, but risk you have measured, documented, and pushed into a contract you can enforce.

Frequently asked questions

What was the SPECTRALVIPER attack on Vietnamese investors?

SPECTRALVIPER is a heavily obfuscated backdoor first documented by Elastic Security Labs on June 9, 2023, used against large public companies inside Vietnam and attributed with moderate confidence to the Vietnam-linked OceanLotus group (APT32). The Hacker News reported in June 2026 that OceanLotus used SPECTRALVIPER in an intrusion that reached users of the FireAnt trading app, a textbook example of why data vendor security matters for investors.

Is ISO 27001 or SOC 2 more important for a data vendor?

They answer different questions, so the strongest vendors hold both. ISO/IEC 27001 certifies that a company runs a complete Information Security Management System across the organization. SOC 2 reports on how specific controls performed against the AICPA Trust Services Criteria over a period. For a financial data vendor in Vietnam, a current ISO/IEC 27001 certificate plus a scoped SOC 2 Type II report is the gold standard for data vendor security.

Does using a web-based data platform reduce supply-chain risk?

It can, because a web-based platform removes the desktop installer and auto-update channel that supply-chain attackers like SPECTRALVIPER often abuse. But it does not remove the risk entirely: the platform itself becomes the supplier inside your trust boundary. The same five data vendor security questions apply, with extra attention to encryption, access control, and where the platform hosts your data.

What does Vietnam's Personal Data Protection Law require of data vendors?

Under Decree 13/2023/ND-CP (effective July 1, 2023) and the Law on Personal Data Protection No. 91/2025/QH15 (effective July 1, 2026), organizations that process Vietnamese personal data must obtain consent, honor data-subject rights, run impact assessments, and notify breaches. Because these duties can flow to you as the controller, strong contractual data vendor security terms are how you stay compliant.

How often should I review my data vendor security?

Review at every contract renewal at minimum, and refresh certificates annually, since ISO/IEC 27001 and SOC 2 reports have expiry and coverage periods. Trigger an out-of-cycle review whenever the vendor suffers an incident, changes ownership, or moves hosting. Treating data vendor security as a living checklist, not a one-time box tick, is what keeps the review meaningful.

Sources

• Elastic Security Labs, "Elastic charms SPECTRALVIPER", elastic.co, June 2023.
• The Hacker News, "OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack", thehackernews.com, June 2026.
• Vietnam Briefing, "Vietnam Law on Personal Data Protection: Overview", vietnam-briefing.com, 2025.
• Tilleke & Gibbins, "Vietnam's New Personal Data Protection Law: A Closer Look", tilleke.com, 2025.
• International Organization for Standardization, "ISO/IEC 27001 Information security management systems", iso.org, 2022.
• AICPA, "Trust Services Criteria (SOC 2)", aicpa-cima.com, 2017 (revised 2022).