01 · Security
Swiss-grade security for your due diligence.
Bank-level encryption · Swiss hosting · full audit trail. Compliance is not an add-on, but the platform core.
- DSG · GDPR
- AES-256
- Audit trail
System status
- API Gateway99.97%Status: Operational
- Document Storage99.99%Status: Operational
- AI Workstreams99.95%Status: Operational
- Auth Provider99.98%Status: Operational
Certifications
- ISO 27001:2022In progress
Target Q4 2026
- SOC 2 Type IIPlanned
Target Q1 2027
Compliance documents
- Download
DPA template (Data Processing Agreement)
EU-GDPR Art. 28 + Switzerland DSG Art. 9 compliant.
- Download
Sub-processors list
Current list of all sub-processors with region.
- Request
Penetration test report (sanitised)
Q1 2026 test, results + remediation.
- Download
Security whitepaper
Architecture, threat model, encryption standards.
Pen-test (sanitised)
Last external penetration test: 02/2026. Sanitised report on request.
Compliance contact
03 · Roadmap
Certifications in the pipeline.
We only communicate what's actually achieved — and what's currently in progress.
DSG / EU-GDPR
AchievedSince 2024
Fully compliant since platform launch. DPA template available on request.
Request documentPen-Test 2026 Q1
AchievedSince 02/2026
External penetration test completed. Sanitised report on request.
Request documentISO 27001:2022
In progressTarget Q4 2026
Stage-1 audit completed. Stage-2 planned for Q3 2026.
SOC 2 Type II
PlannedTarget Q1 2027
Planned audit window after ISO 27001 completion.
04 · Data residency
Data stays in Switzerland.
Primary and DR region within Switzerland. No US cloud, no EU routing for storage. Key management in Swiss HSM.
- Primary region
- Switzerland · Zurich (ZH1)
- DR region
- Switzerland · Geneva (GE1)
- Backup frequency
- Hourly · 30-day retention
- Cross-border transfer
- None — data does not leave Switzerland
ZH1
Zurich
GE1
Geneva
05 · Audit trail
Every action. Every user. 7 years.
Four properties that distinguish our audit trail from typical activity logs.
Who · What · When
Every read/write logged with user ID, document, timestamp (UTC), IP. No trail bypass — admin actions visible too.
7-year retention
Audit logs WORM-archived for 7 years (append-only, immutable). Meets FINMA and Swiss DSG retention requirements.
Export at the push of a button
Complete DD audit trail exportable as signed JSON or PDF. For IC reviews, regulator inquiries, post-mortems.
Tamper-evident
Each log entry is hash-chained. Manipulation visible at verification. Keys rotate quarterly.
06 · Compliance contact
Questions about security or compliance?
Direct line to our security team. No sales filter, no Tier-1 support.