Encryption
- Personal data is encrypted at the field level with AES-256-GCM
- Search over encrypted data via a blind index without decryption
- Encryption key rotation with re-encryption and no service downtime
- Data is transmitted over TLS only
Borrower data security
A borrower’s credit report and passport are the most sensitive data a lender receives. The platform is designed so that leaks, substitution or silent changes are technically difficult, and every access to the data leaves a trace.
Four layers of protection
Isolation
- Organization data is separated by filters that deny access by default
- The storage file key is derived by the server from the organization and the check
- Documents open via short-lived signed links
- The borrower portal never receives a lender staff session
Incoming files
- Every file is scanned by ClamAV antivirus, and an unscanned file goes no further
- File type is detected by content, not by extension
- Archives are limited by file count, size and compression ratio
- Protection against archive bombs and path traversal
Access
- Staff sign in with A3.ID using two-factor authentication
- Seven roles and eleven permission areas for API keys
- IP address allowlist for the organization API
- Rate limiting on public endpoints
Data retention and deletion
Borrower data should not be kept longer than the lender needs it. The retention period is set per organization, and when it expires, both the check and everything extracted from it are deleted.
- Retention period per plan or organization policy
- Deletion on expiry erases extracted data, check results and PDFs
- A legal hold preserves a check for the duration of a dispute or regulator request
- Borrower consent is stored with a hash of the exact text they saw
A trace of every action
Decisions, corrections, signing and even opening a document are recorded in an immutable history with the staff member, time and address. An evidence package for the regulator can be exported for any check.
Where the regulator requires
If borrower data must not leave the bank’s environment, the platform is installed in your infrastructure from ready-made containers and a Helm chart, with data migration between installations.
- 01A3 cloud with organization isolation
- 02Dedicated installation with a separate database and your own keys
- 03Installation in the bank’s environment: Docker, Helm, mTLS, single sign-on
- 04Monitoring via OpenTelemetry and Prometheus, service readiness checks
Reference standards
Security processes are built with ISO 27001 and GDPR personal data processing requirements as reference points. A compliance document package for the bank is included in the Enterprise plan.
Shall we fill in your security questionnaire?
Send us your information security team’s questionnaire: we will complete it and walk through the architecture in a meeting with your team.