Skip to content
& Let's
Procurement readiness

Everything your vendor-security team needs.

Buying software for a government or development bank means clearing a vendor-security review first. Here is the whole kit — what we can hand over today, what we’ll complete for your file on request, and exactly where our SOC 2 effort stands. We state an artifact as available only when it genuinely is, and describe the concrete control wherever a formal badge isn’t in place yet.

Request the kit under NDA →

What’s in the kit

How authentication/MFA, row-level access control, encryption in transit and at rest, and least-privilege service roles are implemented.
Available now
Institutional DPA covering processing scope, security measures, and breach-notification obligations.
Available now
The maintained list of infrastructure providers that process data on our instructions, each with its role.
Available now
Security questionnaire (SIG Lite / CAIQ)
We complete your standardized questionnaire — SIG Lite, CAIQ, or your institution's own template — for your vendor file.
On request · under NDA
Data residency & processing locations
Where hosting and the database physically run, and how residency requirements are handled for institutional customers.
On request · under NDA
Vulnerability & testing posture
Our current application-security testing practices and remediation process, described in detail for your review.
On request · under NDA
Incident response & breach notification
How incidents are detected, escalated, and disclosed, including the notification timeline committed in the DPA.
On request · under NDA
Service levels & support
Target availability, support channels, and response commitments for institutional plans — set out in a mutual agreement.
On request · under NDA

SOC 2 Type II — where we actually are

We are not SOC 2 certified and do not claim to be, and we make no claim to ISO 27001, PCI DSS, HIPAA, or FedRAMP. SOC 2 Type II is a readiness effort in progress. The dates below are targets, not commitments— they will move as the audit progresses, and we’ll keep this page current.

  1. Trust Services Criteria mapped to shipped controlsComplete
    AICPA TSC mapped to controls that operate in the platform today.
  2. Third-party readiness assessment (gap analysis)Target Q4 2026
    Independent firm assesses control design against SOC 2 Type II.
  3. Gap remediation & evidence collectionTarget Q1 2027
    Close identified gaps and begin collecting control-operation evidence.
  4. SOC 2 Type II observation windowTarget Q2–Q3 2027
    Controls observed operating over a continuous 3–6 month period.
  5. Independent SOC 2 Type II report issuedTarget Q4 2027
    Auditor's report available to institutional customers under NDA.
Trust & security overview →Data Processing Agreement →Pay by PO / invoice →