-min.avif)
Enterprise-grade security, independently verified
We protect every transaction with ISO 27001 certification, annual SOC 2 Type II audits, regular independent penetration testing, and continuous monitoring.
Explore our Trust CenterProtecting the data that moves with every transaction
The Travel Rule requires institutions to share sensitive customer data with every transaction. We carry it over encrypted data rails, audited by independent firms, so you can transact with institutions worldwide safely and compliantly.
Built to meet the highest standards
Our controls are built and audited against these certifications and regulations. The reports are in our Trust Center.
Privacy embedded by design, at the protocol layer
Our platform runs on TAP, the open Transaction Authorization Protocol, so privacy controls are part of every transaction message.
Every data element is signed individually as a W3C Verifiable Credential, so any change to it is detectable and it can be audited externally.
Our managed PII service holds personally identifiable information (PII) in escrow under multiple layers of encryption, and counterparties can't access it until compliance checks clear. It's optional: if you prefer, you can manage the encryption yourself.
All data is encrypted end to end, at rest and in transit. Customer-managed keys give you full control over your data.
Full logical isolation between tenants, with configurable data residency and physical segregation options for enterprise customers.
Certified, verified, and continuously audited
Independent auditors, continuous automated monitoring, and outside penetration testers check our controls:
Security that plugs into your existing stack
Connect your identity provider (Okta, Google Workspace, or any SAML provider) and set your own rules for adding users.
Granular, compliance-specific roles for multiple levels of personnel, aligned to your Travel Rule workflows.
Every action is logged and exportable, so your internal teams and regulators have audit-ready records.
Security questions, answered
We hold ISO 27001:2022 certification and complete an annual SOC 2 Type II audit covering the Security and Privacy categories. Our Cloud Security Alliance CAIQ is available through Whistic, and Vanta monitors our SOC 2 controls continuously. Current reports are in our Trust Center.
All PII records are encrypted individually, at rest and in transit. Using our managed PII service is optional. If you prefer, you can encrypt the data yourself and manage your own keys for signing and encryption. PII shared under the Travel Rule is also held in encrypted escrow until counterparty due-diligence checks clear, on every transaction.
Multiple regions are available for data storage, and enterprise customers can opt for full physical data segregation. All tenants are logically isolated, and data is individually segregated to preserve privacy, ownership, and exportability per institution.
We work with independent, CREST-certified penetration testers, including Cobalt and LRQA, who run regular assessments across all our platforms. Our executive team reviews the results, and test summaries are available in our Trust Center under NDA.
We comply with the EU GDPR and Singapore's PDPA, and we're prepared for DORA requirements on EU financial entities. A plug-and-play consent component helps you meet your own Travel Rule privacy obligations.
Start in our Trust Center. It has our current SOC 2 report and ISO 27001 certificate, continuous monitoring dashboards, penetration test summaries, and our CAIQ, with deeper evidence available under NDA on request. Enterprise evaluations can also include security questionnaires and deep-dive sessions with our security team.
Yes. We keep a current list of vetted sub-processors in our Trust Center. Each one is security-reviewed before onboarding and reassessed on an ongoing basis, and we notify customers of material changes.
Still have questions? Talk to our team.
Our team can walk you through our controls, share documentation under NDA, and help with your security questionnaire.
Talk to our team