CALGARY⁠ — Employees at Neo Financial, a Calgary-based fintech with ambitions to disrupt the Canadian financial sector, use personal devices when handling customer data, an internal company policy that some sources say has put its clients’ sensitive information at risk. 

Under the internal policy—which some employees refer to as bring-your-own-device, or “BYOD”—the company has most employees use their own laptops or mobile phones rather than provide them with Neo-owned devices. Neo, which employs nearly 900 people according to PitchBook, administers the Hudson’s Bay rewards credit card and offers several financial products including a cash-back Mastercard and high-interest savings account backed by Saskatoon-based bank Concentra. 

Six former Neo employees with whom The Logic spoke expressed discomfort about the company’s reliance on personal devices, particularly for employees who could potentially retain sensitive client data on their devices after departing the company. One former employee demonstrated to The Logic that they were still able to access previously downloaded files on their personal device that contained customer data, calling up the name, address, transaction history and social insurance number of a Neo customer.

The Logic has agreed not to name its sources for this story because the company has not authorized them to speak publicly on the matter.

In a written response to The Logic’s questions, Neo said it “recognizes its role in protecting the confidentiality and integrity of all personal information handled by Neo” and said “protecting personal information is a regulatory requirement.” 

The company said it regularly undergoes independent security audits, and is certified under a voluntary compliance standard known as SOC2 (System and Organization Controls Type 2), which was developed by the American Institute of CPAs. 

Neo also said it complies with the Payment Card Industry Data Security Standard, an international data-security framework established by payments giants including Mastercard and American Express. Consumer information, the company said, is “retained only as long as needed to fulfill the purposes for which it was collected.” 

Neo did not comment specifically about its employees’ use of personal devices. 

Neo was created in 2019 by some of the co-founders of the food-delivery app SkipTheDishes—Andrew Chau, Chris Simair and Jeff Adamson—as well as Calgary entrepreneur Kris Read. The company, which hopes to shake up Canada’s stale banking industry by offering a wide array of financial services on a single app, has raised a total of $234 million in funding and last year reached the $1-billion market-valuation milestone. Valar Ventures, Silicon Valley billionaire Peter Thiel’s VC fund, is Neo’s biggest backer. 

In an effort to keep data secure on employees personal devices, Neo does ensure they download VPN and antivirus software, including FortiClient programs, as well as software developed by California-based Netskope that monitors their activity on their personal computers, two sources said. But even with such guardrails in place, employees still had the ability to access and retain client information beyond the parameters of their jobs, sources said. 

“There wasn’t really anything stopping me from downloading everybody’s personal information, keeping it on my laptop and taking it home with me,” one person said. 

One former employee said that, as of early last year, the company didn’t have dedicated programs in place to ensure sensitive data was removed from devices once an employee left. Another former employee described being sat down in a private room after the company let them go in the middle of last year and having a member of the company’s human resources team look over their shoulder to ensure they had properly deleted all Neo-related information from their private device. 

Two people who spoke with The Logic said at least 100 employees would have access to internal Neo data files that include customer information. Those data appear in a range of formats, sometimes in raw forms that need to be “contextualized,” or ran through a separate program, before an average user could interpret them.

One current employee rejected the former employees’ security claims, saying the software Neo has staff install on their personal devices ensure data is not mishandled. 

“I don’t feel as an employee [that] I can do something really any different on this laptop that I happened to purchase versus if the laptop had been provided to me.”  

A second current employee said Neo enforces “pretty aggressive” compliance and security training, and said the company was “very diligent in pursuing solutions or anticipating threats” to its security. 

On its website, Neo touts its “top-of-mind” attention to security in developing financial and software products for other businesses, saying it can help them “confidently scale your program with the highest compliance and security standards.”

Brent Arnold, a cybersecurity expert at law firm Gowling WLG, said the “gold standard” for companies handling potentially sensitive data is to issue corporate devices, but using personal devices with antivirus and other protections is the next best thing. Arnold did not comment on Neo in particular. 

He said security lapses can occur when using personal devices in scenarios when employees leave a company, particularly for those feeling aggrieved about a layoff or firing. 

“When it’s the company’s devices, they have to turn them back in. And if you set things up the way that I would want them set up, you can remote-wipe them in case that person disappears with the phone or the laptop.” 

Two former employees told The Logic that Neo did not remotely wipe their devices after they left the company. 

As to why the company has opted to use personal devices, three sources who spoke to The Logic attributed Neo’s BYOD policy to what they viewed as management’s desire to keep costs down. One source said they raised concerns about the policy with management, but was told that it would be too expensive to buy personal devices for all employees. 

Those efforts in turn fit into what one person called Neo’s “hustle, high-performance” work atmosphere, where employees are expected to work long hours in order to meet demanding timelines. 

As The Logic previously reported, Neo has launched new financial services and products at a rapid pace in recent years as it seeks to grow its customer base and tap into new sources of revenue. In that context, two people said, the company did not develop fully fleshed-out internal processes, resulting in gaps in security measures, particularly in Neo’s earlier years. 

One person described Neo’s management team as pursuing “everything and anything underneath the sun” that might bring in new customers, then quickly changing gears once that particular product or service failed to take hold. 

Management would call a certain initiative “the most important thing about working at Neo, everyone’s off whatever they’re doing [to] focus on this one thing,” the person said. “And then that doesn’t work. A month later, ‘OK, everyone drop what they’re doing, work on this [new] project.’”