Anqa builds the systems regulated institutions use to detect financial crime. Our customers entrust us with their customer records and every transaction behind them, and their regulators hold them accountable for how we handle it. We protect that information as the core of the product.
Our information security management system follows ISO/IEC 27001:2022, and certification is under way. We are also preparing a SOC 2 report covering security, availability and confidentiality.
Our commitments#
- Protect the confidentiality, integrity and availability of every piece of information our customers entrust to us.
- Meet the legal, regulatory and contractual requirements that apply to us, including the residency, retention and audit obligations our customers’ supervisors place on them.
- Run and keep improving our security management system, with measured objectives reviewed by top management.
The principles we work to#
- Customer data stays where it belongs. Where a contract or regulator confines data to a country or environment, we enforce that technically, and it covers logs, diagnostics, backups and support work.
- Tenants are kept apart. Each customer’s data is isolated in the database itself, and that isolation is tested automatically on every change and checked again on the live platform every six hours.
- Encryption by default. Data is encrypted in transit, our screening data is encrypted at rest under keys we control, and off-site backups are encrypted before they leave the platform.
- Least privilege. Access is granted on need and recorded, and access to a customer-controlled deployment runs through a channel the customer agrees.
- An evidential record. Administrative actions and screening decisions are written to a tamper-evident audit log, kept for the periods our customers’ regulators require.
- Controlled change. Every change is reviewed and tested before release, and only named engineers can release to production.
- Incidents reported promptly. We tell affected customers within the timeframes in their contracts and complete a root-cause review.
Request the policy#
Our Information Security Policy (ANQA-ISMS-002) is available to customers, prospective customers and certification bodies on request, together with the scope of our management system. Customers running a security assessment can also request our assessment pack under a confidentiality agreement. Contact Daniel Rogers, Chief Executive Officer, at daniel.rogers@anqacompliance.com.