Security and data.
The checklist a compliance buyer works through, answered with what exists rather than with what sounds reassuring. Where something is not settled, it is not listed.
Controls
| Control | What is actually in place |
|---|---|
| Encryption in transit | All traffic to the application and the public site is served over TLS. HTTP Strict Transport Security is set with a two-year max-age and preload. |
| Encryption at rest | The database and its backups are encrypted at rest by the managed database platform. |
| Access control | Role-based, enforced server-side. Owner-admin, MLRO, analyst and auditor each get different rights, and a read-only auditor role exists so read access does not imply write access. Tenant isolation is enforced by row-level security in the database, not by application filtering. |
| Audit logging | Append-only and server-only. The audit log rejects UPDATE and DELETE for every role, and no client can write to it at all. |
| Evidence integrity | STR packs, screening dispositions and the training register are insert-only. A correction is a new row that supersedes the old one; both remain readable. |
| Four-eyes on closure | Consequential case closure requires a second, different approver, refused by the database rather than by hiding a button. |
| Backups | Automated daily backups with point-in-time recovery, provided by the managed database platform. |
| Data retention | Customer data is retained for the life of the agreement. Because the evidence stores are append-only, records are superseded rather than overwritten. Deletion at the end of the agreement is governed by the customer agreement. |
| Incident handling | We investigate, contain and notify affected customers without undue delay, with the notification timing set in the customer agreement. We have had no security incident to date. |
| Data deletion | On termination a customer may export their data for a reasonable period, after which it is deleted or returned per the customer agreement. |
| Public site isolation | The public pages are statically generated and carry no session, no customer data and no application code. Content-Security-Policy is default-src 'self' with frame-ancestors 'none'; there are no third-party scripts, analytics or tracking pixels. |
No security certification is claimed. We hold neither ISO 27001 nor SOC 2, and would rather point you at what the product enforces than at a badge.
Sub-processors
The providers that touch data on our behalf. Each processes under contract and on our instructions.
- Supabase
- Managed Postgres database and authentication for the application.
- Vercel
- Application and website hosting, and request logging.
- Resend
- Outbound transactional email — approval notifications and replies.
- Forward Email
- Inbound forwarding of messages sent to our published address.
- Microsoft
- The mailbox in which we receive and keep correspondence.
What the record keeps behind every decision
Each row is enforced by the database. This is the same table the product's own evidence trail produces.
| Rule | R04 Structuring pattern · version 1 | |
|---|---|---|
| Parameters in force | Threshold BD 6,000 · band 70–99% · window 7 days · minimum 3 transactions | |
| Raised | Monitoring run · 3 transactions linked, BD 15,950 in the window 3–9 July | 2026-07-11 09:14 |
| Assigned | Analyst · taken from the queue | 2026-07-11 09:20 |
| Rationale recorded | “Deposit pattern is inconsistent with the declared monthly volume. Escalating for review.” | 2026-07-11 09:52 |
| Escalated to case | Case opened · closure will need a second approver | 2026-07-11 09:53 |
| Approved | MLRO · a different person from the analyst | 2026-07-12 10:03 |
| Later correction | Added as a new entry. The rows above stay exactly as they were written. | 2026-07-14 11:26 |
- Append-only history
Corrections add to the record rather than rewriting it.
- Inspection-ready evidence
Alerts and cases retain what's needed to reconstruct the decision.
- fast, keyboard-friendly investigation workflows
Command search reaches any page, customer, case or screening from anywhere with one keystroke. No figure is published for this: the benchmark runs in CI on our hardware, which says nothing reliable about a buyer's.
Book a demo.
A working walkthrough on your questions rather than a slide deck.
Sunday to Thursday, 9am to 5pm Bahrain time. WhatsApp is usually fastest; email reaches us either way.
Call: +973 3617 8912
Invoiced by bank transfer. Prices exclude applicable VAT.