About / Security
Controls that an independent auditor has examined.
Clients send us loan, position and cash data. The platform that holds it has completed a SOC 2 Type 2 examination, which tested whether our controls operated effectively throughout a full year, January to December 2025, and not only whether they exist.
SOC 2 Type 2 examinedSecurity, availability and confidentialityExamination period: January to December 2025
The examination
What the SOC 2 report covers.
The report is restricted in its distribution. We share it with clients and prospective clients under a confidentiality agreement.
- Type of report
- SOC 2 Type 2: an independent service auditor’s report on the design and the operating effectiveness of controls.
- Period examined
- January 1, 2025 to December 31, 2025.
- Criteria
- The trust services criteria for security, availability and confidentiality.
- System in scope
- The Dacumen platform, including Orion, SmartRec, TradePath and Levfolio.
- Auditor’s opinion
- Unqualified. In the auditor’s opinion the controls were suitably designed and operated effectively throughout the period, in all material respects.
- Examined by
- An independent CPA firm, under the attestation standards of the American Institute of Certified Public Accountants.
Practices
How client data is protected.
These practices are described in the system description that the auditor examined.
- Hosting
- Production systems run on Amazon Web Services, in data centers with multiple availability zones and failover.
- Encryption
- Data is encrypted at rest and in transit. Backups are encrypted, and access to them is restricted.
- Access
- Access is granted by role, on a least-privilege basis, and reviewed quarterly. Production systems can be reached only with multi-factor authentication.
- Network
- Network connections are denied unless explicitly permitted.
- Testing
- Regular vulnerability scans, and penetration tests of the production environment by a third party.
- Change control
- Changes to applications and infrastructure follow a documented development life cycle, with testing and approval before release.
- Incidents and continuity
- A documented incident response plan, including notification procedures, and monitored backups of client data.
- People
- Background checks on hiring, security training, and confidentiality agreements with employees, contractors and third parties.
Shared responsibility
What remains with the client.
Some controls can only be operated by the client: who is authorized to use the system on its behalf, for example, and how its own users are managed. The SOC 2 report lists these complementary controls, so a client’s risk and audit teams can confirm them on their side.
Client data is used only for the purposes stated in our agreement with the client.
Request the SOC 2 report.
We provide the full report, and answer due diligence questionnaires, under a confidentiality agreement.