DPA & security
This page summarises how AML Hub is designed to protect the data of the platforms that use it. Binding terms are set out in the contract pack and the data processing agreement.
Last updated: [date to be set on publication]
Roles under the GDPR
Each client platform is the controller of its customers' personal data. AML Hub acts as processor under Article 28 GDPR and processes that data only for anti-money-laundering purposes.
Data separation
Each platform has its own data plane and its own encryption key. Customer data is never pooled across platforms, and no cross-platform customer record exists.
Access control
Role-based access, MFA or single sign-on, and configurable 4-eyes approvals. AML Hub staff have no access to customer data by default; any exceptional access is approved by the client, time-limited and logged in the client's audit log.
Audit log and retention
Append-only, hash-chained audit log. Case records are kept for 5 years after the business relationship ends (AMLR Art. 77) and then deleted, unless a legal hold applies.
Hosting and sub-processors
Hosted in the European Union. [Sub-processor list to be published.]
DORA and contract pack
The contract pack covers the outsourcing agreement, DORA contract clauses, the GDPR data processing agreement and an exit plan with full data export. [Templates to be published after legal review.]
Certifications and testing
ISO/IEC 27001 certification is on our roadmap, targeted within 12 months of launch. AML Hub is not certified today. [Penetration testing schedule to be confirmed.]
Requesting the DPA
Book a demo or contact us to receive the draft data processing agreement and security documentation. [Contact details to be completed.]