Security is the product.
We screen financial crime for a living - so our own posture has to hold up. Read how we encrypt, where we host, who has access, and where each certification stands.
Compliance posture
Standards, audits, certifications
SOC 2 Type II
Application planned. We publish progress here as soon as the audit starts.
ISO 27001
On the roadmap after SOC 2. Controls are being documented against the standard now.
GDPR
Data-processing agreement on request; retention, deletion and subject-access requests handled within the statutory period.
FATF methodology
Screening supports customer due diligence and ongoing monitoring (FATF Recommendation 10) and PEP checks (Recommendation 12). Travel Rule (Recommendation 16) support is planned.
Card data
We never store card numbers; payments are processed by our PCI-compliant payment provider.
Data residency
Hosted in the UK today; dedicated regions can be discussed for Enterprise contracts.
Security controls
How we protect customer data
Encryption
TLS in transit everywhere; the credentials you give us for integrations and mailboxes are encrypted with AES-256-GCM at the application layer.
Tenant isolation
Every query is scoped to the caller's tenant; cross-tenant access is denied at the API layer.
Least privilege
Role-based access with short-lived tokens; admin access is logged.
Audit logging
Admin actions carry actor, IP and timestamp and are retained for audit.
DDoS + WAF
Edge protection, bot mitigation and WAF via Cloudflare.
Continuous testing
Backend dependencies are checked for known vulnerabilities on every deployment; independent penetration testing is planned alongside the SOC 2 application.
Programs
Data residency
Where we keep your data and how we control where it travels.
Read morePrivacy center
DSAR, retention, deletion - how we honour every right.
Read moreSubprocessors
Every third party that may handle customer data.
Read moreSLA & DPA
Service levels and data-processing agreements.
Read moreCertifications
Where each framework stands today.
Read more