Security and data handling.
Screening data is regulated data. This page sets out how we meet data residency requirements, how the platform controls access to it, and where our independent audits stand.
Data residency, audits and your data at exit.
Meets Canadian and local data residency requirements
Our production environment stores and processes screening data in line with Canadian data residency requirements and the local requirements of the jurisdictions our customers operate in.
SOC 2 and ISO/IEC 27001 audits underway
Both independent audits are in progress. This page will be updated as each one completes.
Your records leave with you
When a subscription ends, your case history and audit trail can be exported in standard formats.
Controls an examiner can follow.
Each of these is part of how the screening platform handles data and decisions.
Hashed API credentials
API keys are issued per account and environment, stored only as hashes, and can be revoked and rotated.
Deny-by-default access
Every action is checked against the permissions of the person or integration making it. Anything not explicitly permitted is refused.
Append-only audit trail
Screening decisions, configuration changes, approvals and refused requests are recorded in a ledger that cannot be edited after the fact.
Maker-checker on material changes
Screening policy changes and closures of high-risk cases need an independent second approver. Nobody approves their own decision.
Human review of material decisions
Automation prepares evidence and recommendations. Material decisions stay with your analysts, under the policy you approve.
Retention with a regulatory floor
Retention cannot be set below the minimum record-keeping period, and records under legal hold or tied to an open case are never erased.
Sending us a security questionnaire?
Our team handles vendor due-diligence requests directly. Send your questionnaire and we will respond with the documentation available at the current stage of the audits.
Security questions, answered.
Do you meet data residency requirements?
Yes. Our production environment meets Canadian and local data residency requirements. SOC 2 and ISO/IEC 27001 audits are underway, and our security page sets out the controls built into the platform.
Do you hold SOC 2 or ISO/IEC 27001 certification today?
Not yet. Both audits are underway, and this page will be updated when each completes. In the meantime, we answer security questionnaires directly and walk your team through the controls described here.
Are we locked into a long-term contract?
No. Subscriptions are billed monthly or annually, and either can be ended for convenience on 30 days’ notice. When you leave, your case history and audit trail can be exported in standard formats, so your record of past decisions stays with you.
Fewer alerts. Faster investigations. Decisions you can defend.
See our platform screen a live customer against global sanctions, PEP and adverse media data. Book a demo with our team.