Your data is protected
AML PROOF applies technical and organisational measures to keep your compliance data secure and accessible only to authorised persons.
Data Encryption
Data is stored with certified providers (Vercel, Neon, Amazon Web Services) with encryption at rest. Data in transit is protected with TLS encryption.
Modern Authentication
Login is protected by magic link and OAuth 2.0 (Google, Microsoft). Optional two-factor authentication (2FA/TOTP) via authenticator app is available for every user.
Secure Infrastructure
Our infrastructure is hosted on Vercel, which is SOC 2 Type II certified with 24/7 monitoring, automated threat detection, and regular security audits.
Access Controls
Role-based access control (RBAC) with the principle of least privilege. Critical actions are written to the audit log.
Data Backup & Recovery
The database keeps a recovery history of 7 days and daily snapshots retained for 14 days. Uploaded files are backed up daily, encrypted, to Amazon Web Services S3 in the EU (Sweden).
Audit Logging
Audit log of critical actions and steps in checks, protected against alteration (HMAC). Records are retained according to the periods in the privacy policy.
Regulatory Compliance
We govern the processing of personal data by the GDPR and the AML Act.
GDPR
Personal data is processed in accordance with the General Data Protection Regulation (GDPR).
- Data minimization and purpose limitation principles
- Right to access, rectification, and erasure (right to be forgotten)
- Data portability and consent management
- Notification of a personal data breach to the controller without undue delay (Art. 33(2) GDPR)
Legitimate Interest Assessment (LIA)
We are preparing legitimate interest assessments for the following processing:
- Customer support
- Commercial communications
- Security and error monitoring
- Usage analytics
Data Protection Impact Assessment (DPIA)
A data protection impact assessment (DPIA) is being conducted in line with Art. 35 GDPR.
- Mapping of all personal data processing operations (completed)
- Assessment of risks to the rights and freedoms of data subjects (in progress)
- Adoption of technical and organisational measures based on findings
Records of Processing Activities (ROPA)
We keep records of processing activities under Art. 30 GDPR:
- Activities as processor for obliged entities and as controller
- Legal basis documentation for each processing purpose
- Data categories, retention periods, and transfer records
- Regular updates and supervisory authority availability
Data Storage & Encryption
Encryption Standards
- AES-256 encryption at rest at certified providers (Vercel SOC 2 Type II, Neon, Amazon Web Services)
- Encryption in transit (TLS)
Storage Infrastructure
- Database and files in the EU (Frankfurt), file backups in the EU (Sweden)
- Database recovery history of 7 days, daily snapshots for 14 days
24/7 Security Monitoring
Our systems are monitored continuously by automated tools. We typically resolve security incidents within 24 hours of detection.
Current System Status
Check the current status of the platform services.
Questions About Our Security?
Our security team is available to answer any questions about our data protection measures and compliance standards.
Register your obliged entity
Registration is simple — just a few clicks, and it's free.
Starter plan at no cost. No credit card required.