All communications between your browser and our servers are protected by the TLS 1.3 protocol (Transport Layer Security), the most recent and most secure encryption standard, encrypting all data exchanged and preventing any interception or reading of it by a third party. This protocol guarantees the confidentiality and integrity of the data exchanged, in particular your personal and banking information and the documents you upload during your credit application. The presence of the padlock and the "https://" prefix in your browser's address bar attests to this protection at every moment of your browsing.
Our servers are hosted in ISO 27001 certified datacenters — the international reference standard for information security management, attesting to rigorous risk management, access control and business continuity processes — equipped with redundancy systems and regular automatic backups guaranteeing continuous service availability even in the event of a major technical incident, as well as reinforced physical protection measures (biometric access control, 24/7 video surveillance, continuous monitoring by dedicated staff). Data is stored exclusively within the territory of the European Union, in accordance with GDPR requirements regarding transfers outside the European Economic Area.
Access to your Sodefina client area is protected by a strong two-factor authentication (2FA) system, in accordance with the requirements of the European Payment Services Directive (PSD2), which requires strong customer authentication for access to online banking services and sensitive operations. When you log in from a new device or during sensitive operations (IBAN modification, early repayment), additional validation is requested via a code sent by SMS or by push notification on the mobile application — which benefits from the same security standards as our website.
Our systems continuously analyse suspicious login attempts (unusual location, repeated incorrect code attempts, atypical behaviour) and automatically trigger a temporary block of the account in the event of suspected compromise. You are alerted immediately by email if unusual activity is detected on your account — login from a new device, a change to your bank details, or an attempted sensitive operation — allowing you to react immediately in the event of unauthorised use.
All card payments made on our site are processed by payment service providers certified PCI DSS (Payment Card Industry Data Security Standard), the security standard required by all international card networks. Your card data never passes through our servers and is never stored by Sodefina. The 3D Secure protocol (Visa Secure, Mastercard Identity Check) adds an additional authentication layer for all online payments, by requesting validation from your bank at the time of payment, significantly reducing the risk of card fraud.
Direct debits (repayment of your monthly instalments) are carried out via the SEPA direct debit system, which offers a challenge period of 8 weeks for authorised debits (13 months for unauthorised debits). In the event of a challenged debit, your bank is required to refund you immediately.
Sodefina S.A. is subject to the permanent supervision of the Banco de Portugal, which verifies compliance with prudential and customer protection standards. Our information systems are subject to regular security audits, conducted by independent providers specialising in cybersecurity, to continuously verify the effectiveness of our protective measures against the latest threats. We also carry out periodic penetration testing, conducted by offensive security experts independent from our development teams, to identify and correct potential vulnerabilities before they can be exploited.
In accordance with the GDPR and the NIS2 directive (Network and Information Security), we have a structured security incident management process, including detection, analysis, containment and remediation of any incident affecting our information systems. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we are required to inform you as soon as possible and to notify the CNPD within 72 hours.
Your vigilance is the first line of defence against fraud. Sodefina will never ask you by telephone, email or SMS for your access codes, your PIN, your full card numbers or your 3D Secure code. If you receive such a request, it is a phishing attempt. Hang up immediately and report the incident to us at security@sodefina.eu.
The documents you submit as part of your credit application (proof of identity, proof of income, bank details) are transmitted exclusively via encrypted channels: your secure client area or our internal messaging service, never by unencrypted email.
In accordance with applicable regulations, Sodefina implements identity verification procedures (KYC) and transaction monitoring as part of the fight against money laundering and terrorist financing, contributing to the overall security of the financial ecosystem.
If you suspect fraudulent use of your account or a phishing attempt impersonating Sodefina, contact us immediately by email at security@sodefina.eu, via our contact form, or via the secure messaging of your client area. You can also report phishing attempts to the Portuguese platform CNCS: www.cncs.gov.pt; Sodefina also cooperates, as needed, with the CNCS (Centro Nacional de Cibersegurança), Portugal's national cybersecurity body, notably for this type of reporting.
Beyond the technical measures described on this page, Sodefina deploys a comprehensive programme to raise awareness among and support its customers against the risk of fraud, detailed on our dedicated fraud prevention page.
Is my banking data stored by Sodefina? No, card data never passes through our servers and is never stored.
What should I do if I lose access to my client area? Contact our customer service for a secure recovery procedure.
Is Sodefina ISO 27001 certified? Our hosting infrastructure is, guaranteeing a high level of security.
Can I access my customer area from public Wi-Fi? We advise against it; use a VPN or your personal mobile connection if necessary.
Simulate your project in a few clicks — simple and commitment-free!
Please enter an amount between €3,000 and €75,000
Repayment term
Simulate your project in a few clicks — simple and commitment-free!
Personal loan of 5,000 €
Your personalised simulation
— Our loan proposal is adjustable —
(1) Excluding optional insurance. Indicative simulation. Subject to acceptance. Indicative fixed APR. Credit is a commitment and must be repaid. Check your repayment capacity before taking out a loan.
Simulate your project in a few clicks — simple and commitment-free!
Personal loan of 5,000 €
The optional monthly insurance premium is 0.70% of the outstanding balance. The first premium is the highest. Check your eligibility.