Key takeaways:

Our industry survey shows 87% of wealth management executives complain about low-quality integration. In contrast, Sombra’s wealth management clients receive software with 95%+ interoperability;
Sombra works with verified third parties like MorningStar, Blackrock, Alladin, and Salesforce;
We are ISO 27001- and SOC2-certified. Also, hold regular employee security training.

Low-quality integrations is the biggest headache of wealth management executives. Working with one of the WM’s world moguls, we’ve gathered the knowledge of how to build a solid software architecture for financial advisor digital solutions.

Interoperability

Each advisor platform for our wealth management clients reaches 95-98% interoperability with external systems.

Metrics we track to measure high interoperability:

Percentage of successful requests between the advisor system and integrated external systems.

Approaches we follow to achieve high interoperability

Great coverage of integration tests. In one case, adding integration testing coverage on 50-60% of test cases improved interoperability by 10%.
Intermediaries for integration management. Applying an intermediary with retry logic between the advisor system and a third party improved the percentage of successful requests to 99%. Intermediary types like API gateways, message queues, and reverse proxies help improve interoperability by applying:

Protocol transformation;
Data format conversion;
Security/authentication management;
Load balancing.

Sombra works with 50+ verified third parties:

MorningStar;
Blackrock;
Alladin;
Salesforce;
Pipedrive;
Hubspot.

Sombra’s checklist for verifying third parties:

1	Ease of integration & time to market	The number of steps needed to integrate; Solid integration documentation.
2	Support & community	Third-party Internet presence (blogs, articles); Availability and responsiveness of the support; Resource and documentation availability for developers.
3	Cost-effectiveness	Price comparison of the top-3 third-party competitors.
4	Protocol support/data format compatibility/API versioning support	Protocol and data compatibility with a needed programming language; Providing semantic versioning to avoid major changes to external systems affecting our system.
5	Security and Compliance	Integration is aligned with industry standards and applicable regulations.
6	Previous experience with a third-party integration	Evaluation of the previous integration experience with a third party.
7	Integration uptime (availability)	A third party’s availability per month must exceed 99% of uptime.
8	Webhook & notifications	Updates on any changes or actions.

Want to develop advisor software with high-quality integration? Book a call with our software asset management consultant today.

Modifiability

Metrics our developers track to ensure high modifiability:

Cohesion — high. Changes related to one entity affect only one module.

Coupling — low. Changes in one module have little impact on other modules.

Cyclomatic complexity — less than 5 per function. The logic of a code-level function must be simple so each developer can understand and change it quickly.

Code duplication — 5% maximum. All code related to the same functionality should be in one place.

Approaches we follow to achieve high modifiability

Quality coding. After launching over 30 fintech projects, Sombra created the “Secure Software Development Policy” and “Software Architecture Principles and Practices.” For code analysis, we use tools like SonarCube and PMD and manual code review.
Modular approach. Having high-cohesion, low-couple portfolio calculation, report, and fund data retrieval modules from the advisor platform leads to 1.5 times faster service releases. Plus, separate teams are responsible for releasing specific services.

Financial planning software

Decoupling advisor platform to individual services for top-10 banks in the world

Performance

Metrics we track to ensure performance:

Response time of the system and each functionality of the system — from 2 to 5 seconds per operation.
Throughput of the system — the number of advisors and/or investors simultaneously working.

Approaches we follow to achieve high performance

Optimization on a server-level

Parallel processing. Adding parallel processing to external portfolio calculation logic improves response time from x2 to x5 times. Also, Sombra uses a distributed processing approach via Apache Spark for large data processing response time.

Financial planning software

Historical fund data processing via Apache Spark

Caching mechanisms. Sombra doesn’t take data directly from third parties for our wealth management projects to save process time. Instead, we prepare data, keep it in the cache, and show it in several seconds when needed.
Content delivery networks. Content delivery networks for static assets like images, static HTML files, and scripts work near the client. Whenever Sombra serves a financial client in North America, it utilizes Content delivery networks in the region.
Using reactive systems to improve response time and throughput via async communication/non-blocking IO, backpressure handling, and streaming.

Financial advisor software reactive systems approach

Using reactive systems to enhance performance for the advisor system

Database level optimization

Proper data indexing. Database indexes improve read query performance by reducing the need for a full table scan. Based on indexed columns, the database engine is able to find relevant records quickly.
Data sharding. Sombra uses several servers in parallel instead of one to receive better performance by parallel processing. Each server keeps some data separated by a partition key. Data for each year was stored on separate physical servers in the case mentioned below.

Financial advisor software data sharding approach

Data sharding for an advisor system

Additional approaches

Regular throughput testing by a QA team.

Monitoring performance:

Application performance monitoring tools:

Profiling tools to optimize slow queries:

Datadog APM,
Elasticsearch APM.

Relational databases:

Psql — pg_stat_statements,
Mysql — MySQL Performance Schema;

Non-relational databases:

MongoDB Profiler,
Elasticsearch Slow Log Analyzer
Elastic APM.

Want to scale your business with Sombra’s wealth management software solutions? Contact us today!

Security

Advisor platforms manage sensitive data, like user financial data, user investment strategies, etc.

Financial advisor software high level architecture

Advisor platform high level architecture

Thus some of the most common threats include:

Phishing attacks – compromised credentials can lead to access to other accounts or sensitive financial data.

Financial advisor software phishing attack possibility

Advisor platform: Phishing attack possibility

DDoS attacks – lead to lack of availability, reputational, and financial damage.
Social engineering attacks, like Business Email Compromise(BEC) attacks. One of the most popular methods used to target investors. In May 2020, a Norwegian investment fund was targeted by a threat actor impersonating a microfinance institution, successfully managing to divert USD 10 million in “funding” from the victim.
Malware/Ransomware may lead to data leaks, fraud, etc.

As an IT vendor we consult our clients on the necessary steps to prevent those attacks and to boost their software architecture security.

4 steps we follow to eliminate threats to advisor software systems

Step 1: Code security.

Tool	Why	Software
Code linters	To identify and mitigate potential security risks like injection attacks, CSRF, security misconfigurations, sensitive data exposure, cryptographic vulnerabilities, dependency vulnerabilities, and many others.	SonarCube, Checkmarx
Dependency analysis		Maven enforcer plugin, OWASP check plugin
Configuration analysis		Trivy

Additionally, code can be checked manually, in terms of the regular code review process.

Step 2: Data security

Encryption protects data from unauthorized use and should be implemented on data in transit or at rest.

Data in-transit	Data at rest
The most common protocol for encrypting data in transit is SSL/TLS	The encryption of data at rest should only include strong encryption methods such as AES or RSA.

According to The Sophos State of Ransomware 2021 report, 54% that were hit by ransomware in the last year said the cybercriminals succeeded in encrypting their data in the most significant attack. 96% of those whose data was encrypted got their data back in the most significant ransomware attack. The average ransom paid by mid-sized organizations was US$170,404. However, on average, only 65% of the encrypted data was restored after the ransom was paid.

Also, data requires regular backups. In 2023, of the organizations with revenue of over $5 billion, 55% got data back by paying the ransom, and 63% used backups. At the same time, 36% of organizations with revenue of less than $10 million recovered data by paying the ransom, while 80% used backups – the highest rate of backup use of all revenue cohorts.

Data recovery ransomware attack

Step 3: Network security

Implementing firewalls and VPN network firewalls ensures safe access to the software environment and protects from external threats.

Network firewalls (enterprise level like Cisco Firepower or cloud based),
VPNs via OpenVPN, AWS VPN, WireGuard or similar
Doing network segregation by implementing a DMZ (Demilitarized Zone which is an isolated area between the internal network and the internet) to control and filter incoming traffic, limit direct access to sensitive internal resources, and reduce the potential direct impact of external threats (like DDoS attacks). See the reference below:

Financial advisor software network security

Advisor platform network security

At Sombra, we use Virtual Desktop Infrastructure (VDI) instead of physical computers in our development process. One of the main reasons for this is that VDI improves security by centralizing data and applications in secure data centers. Robust access control and encryption are applied to all data and applications, which makes them less vulnerable to theft, loss, or damage. In contrast, physical devices are more exposed and are at a higher risk of being compromised.

Step 4: Application security

Application security influences how end-users interact with the advisor software’s security features. They aim to prevent security vulnerabilities against threats such as unauthorized access and modification. Those features include:

Password policy,
Multi-factor authentication (MFA) via tools, like okta, auth0)
Role-based access control.

Additionally, web security verification can be provided via tools like OWASP ZAP.

Step 5: Information security maintenance

Another key to ensuring security of an advisor software architecture is aligning with necessary regulations and compliance, like:

ISO/IEC 27001 (Information Security Management) – is the international standard for information security and is required to formalize and improve business processes with respect to information security and privacy.
The Payment Card Industry Data Security Standard (PCI DSS) – is required for applications handling cardholder data, whether you are a start-up or a global enterprise managed by The PCI Security Standards Council (PCI SSC).
General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) for data privacy.
An Act to modernize legislative provisions as regards the protection of personal information (Bill 64)
SOC 2 is a voluntary compliance standard for service organizations developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data.

Other than that, maintaining high information security includes

providing regular security audits,
employee training,
documenting procedures on restoring security after hacker attacks or DDos attacks, when user data had been compromised.

At Sombra, we have ISO 27001 and SOC2 certifications. As a trusted software development vendor, we also hold regular employee security training.

Availability

Architecture must ensure 99.99% software availability, for advisors to provide timely financial advice and execute trades. Otherwise:

Advisors can not

Retrieve client portfolio information
Retrieve fund or asset information
Generate reports
Communicate with investors

Investors, in their turn, can not access their portfolios.

Metrics we track to ensure availability:

System availability can be measured by a provider’s service level agreement (SLA), which is measured in hours or % of uptime per month.

Big cloud giants like Google, Amazon, and Microsoft have an SLA of at least 99.9% and a maximum 99.99% availability. A fine will be applied if SLA is breached.

Approaches we follow to achieve high availability

Continuous application monitoring is crucial to identify and resolve application issues before they impact customers.
Tools Sombra works with: Prometheus, Graphana, Datadog, Elasticsearch, etc.
Using orchestration tools that allow to scale servers horizontally, meaning maintaining system’s availability by enabling additional servers and redirecting the traffic to those servers. Such autoscaling based on resource consumption via tools like kubernetes horizontal pods autoscaler for containerized workloads to balance the traffic via load balancers (if 1 server down – switch traffic to the other server)
Tools Sombra works with: nginx, haproxy or cloud based like AWS ALB etc.
Cloud service and their respective products help financial firms mitigate and delegate risks of system availability while taking less time to configure. On-premise architecture, on the other hand, costs less but it doesn’t provide high availability and scalability out of the box.
Services Sombra works with: AWS, GCP, Azure
Using deployment strategies like blue-green or rolling update to minimize application downtime when software update is being released. The end-user should not be able to notice any interruptions in the advisor platform.
Regular backups and data replication for databases and storages. Data backup is crucial for an uninterrupted business. It should include databases, files, and more for a quick recovery. Ensuring business continuity requires a robust and tested backup and disaster recovery plan. A quick recovery means RPO/RTO metrics should be satisfied.

Many organizations have multiple RTOs and RPOs that reflect the importance of each workload to their business.

Additional

- Document disaster recovery procedures
- Employee training
- Regular disaster recovery testing
- Alternative or recovery locations

Consult with a trusted software development vendor on your wealth management software architecture for potential weaknesses. Book a call now.

FAQ

What experience does Sombra have with financial advisor software?

Sombra has worked for over 7 years with one of the world’s top-10 banks. Our software development company helped boost the client’s AUM 5-year CAGR to 9.2% and Net Income — to 12.9%.

How does Sombra ensure its regulatory compliance?

Sombra has such certifications:

ISO 27001
SOC2
PCI DSS
ISO 9001:2015

Additionally, Sombra is FSQS registered. Our software is compliant with GDPR, Bill C-81, and other necessary regulations.

What is Sombra’s NPS score?

Sombra’s NPS score is 83 in 2023. Our clients, like Wineshipping, Studio Ninja, and Waterford, highlight Sombra’s technical expertise as well as communication.

How can Sombra help improve architecture’s security?

Based on the chosen cooperation model, our team might have different access to the client’s software. Therefore, different responsibility, yet we ensure:

Code security – always.
Application level security – always.
Data encryption – on demand.
Network security – on demand. Some companies prefer to hire a separate vendor to work with their network.
Information security maintenance – on demand we can be fully- or partly- involved.

For example, the staff augmentation model limits us, as a vendor, to just ensuring code and application level security. The rest is the client’s responsibility.

For detailed information, visit our website here.

Increasing world’s top banks’ AUM CAGR to 9.2% through solid custom financial planning software

Looking for the right team to accelerate your business growth?

Contact Us