Security

Platform architecture

AutoKYC runs as a multi-tenant SaaS platform with logical segregation between customers. Sensitive workloads (document storage, biometric processing, escalation queues) operate inside customer-specific projects with customer-managed encryption keys when required.

• Regional deployments in EU (Frankfurt), UK (London), and US (Iowa) with data residency enforced per tenant.
• Zero-trust network perimeter with service-to-service authentication via mTLS and short-lived SPIFFE identities.
• Immutable audit ledgers capturing workflow changes, analyst votes, and escalation decisions for seven years.

Application security

Our secure development lifecycle includes mandatory code review, dependency scanning, and continuous fuzz testing for high-sensitivity APIs.

Static & dynamic analysis

Git-based SAST and container scanning on every PR, plus nightly DAST scans of authenticated console flows.

Secure SDLC

Threat modeling workshops, pair programming on critical paths, and mandatory security sign-off before release.

Data protection & privacy

We design for principle of least privilege and minimisation across all datasets, including applicant PII, beneficial ownership structures, and biometrics.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) backed by hardware security modules.
• Customer-defined retention policies with automated purge jobs and evidentiary holds for regulator requests.
• Consent-aware SDKs that gate analytics and third-party scripts until end-users opt in.

For contractual commitments, see the Data Processing Addendum.

Access management

Internal access follows a strict separation-of-duties model with quarterly certification and real-time alerts on privilege escalations.

• Okta with hardware-backed MFA for all staff, enforced device compliance, and phishing-resistant WebAuthn.
• Break-glass procedures for incident response with dual approval and automated expiry after 12 hours.
• Case data access logged per analyst, including reason codes and supervisor approvals for escalations.

Business continuity & resilience

AutoKYC performs quarterly disaster recovery exercises and tabletop simulations for regulator audits.

• Point-in-time recovery for core data stores with 5-minute RPO and 30-minute RTO.
• Webhook delivery queues replicated across regions with graceful failover and replay controls.
• Managed services operate follow-the-sun coverage to preserve SLA commitments during localized disruptions.