Security & Compliance Built In
Financial infrastructure demands the highest standards. Our platform is designed with security-first principles and multi-layered compliance controls at every layer.
Know Your Customer (KYC)
Tiered verification framework
Our KYC framework uses a risk-tiered approach. Lower-volume customers can onboard quickly, while higher-volume senders undergo additional verification steps to ensure regulatory compliance.
Up to $10,000 / month
- Company name and registration
- Business email verification
- Terms of service acceptance
- Use case description
Up to $150,000 / month
- All Tier 1 requirements
- Certificate of incorporation
- Beneficial owner ID verification
- Business bank statement
- Compliance questionnaire
Unlimited volume
- All Tier 2 requirements
- Full AML policy documentation
- Ultimate beneficial owner chain
- Third-party KYC report
- Ongoing annual review
Anti-Money Laundering (AML)
Multi-layer transaction monitoring
Transaction Monitoring
Transactions exceeding velocity thresholds or exhibiting suspicious patterns are flagged for manual review before processing.
- Real-time velocity checks (live)
- Structuring pattern detection (live)
- Cross-customer linkage analysis — planned
- Regulatory filing support — planned
Sanctions Screening
Sanctions screening integration is in progress. The platform currently operates in supervised beta with an internal blocklist check on every payout while we complete integration with a licensed OFAC/UN/EU sanctions data provider.
- Internal blocklist screening (live)
- OFAC SDN list screening — in progress
- UN and EU sanctions registers — in progress
- PEP (Politically Exposed Person) screening — planned
Risk Scoring
Each transaction is assigned a risk level based on behavioral signals, with on-chain source-of-funds analysis available when a blockchain analytics provider is configured.
- Behavioral velocity scoring (live)
- On-chain source-of-funds analysis — available with a configured provider
- Geographic risk weighting — planned
- Counterparty risk assessment — planned
Compliance Reporting
Every check and flag is recorded so you can meet your own compliance obligations.
- Full transaction audit trails (live)
- Screening result documentation (live)
- Risk score history export — planned
- Regulatory report generation — planned
Data Security
Encryption, isolation, and access controls
Encryption at Rest
Data at rest is encrypted by our infrastructure providers. Application-level field encryption for sensitive data is planned but not yet implemented — do not rely on it for anything not already covered by provider-level encryption.
Encryption in Transit
All API and webhook traffic is served over HTTPS/TLS. We do not have a mobile SDK today, so certificate pinning isn’t applicable yet — see the Node.js and Python SDKs in our developer docs.
Environment Isolation
Every request is routed by an explicit environment flag, with separate provider credentials for sandbox and production — a sandbox request can never reach real payment rails. Sandbox and production currently share underlying database infrastructure, logically separated by environment.
Access Controls
Role-based access control (RBAC) for dashboard users. API keys scoped by permission set. All privileged access is logged and audited.
Audit Logging
Every administrative action and API-key-authenticated request is logged with actor, action, and timestamp. Our internal financial ledger is append-only and cryptographically enforced immutable at the database level — audit logs themselves are not yet on tamper-evident storage or a defined retention schedule.
Incident Response
We maintain internal runbooks for common operational incidents. A formal incident-response process with defined recovery-time objectives and customer-disclosure timelines is still being built out as we scale — ask our team for our current practice if this is a requirement for your evaluation.
Regulatory Framework
Settlra Technologies Ltd operates under applicable regulations in our operating jurisdictions. We are building our compliance program with FATF recommendations for virtual asset service providers (VASPs) in mind. The platform currently operates in supervised beta — full compliance documentation is in progress and will be made available to enterprise customers under NDA as it is completed.
SOC 2 Type II
In Progress — Expected Q1 2026
FATF VASP Compliance
Alignment planned
GDPR
Compliance in progress
ISO 27001
Coming soon
Need our security documentation?
Enterprise customers can request our full security whitepaper, penetration test reports, and compliance documentation.
Contact Security Team