Due diligence

AMLOK security reviews focus on the products and deployment your institution will use. Agree the review scope and available materials with your AMLOK contact.

​

Scope the review

Identify the products, deployment, sources, jurisdictions, information sensitivity, dependencies, and intended actions. Align the review with your institution’s third-party risk process and service materiality.

​

Evidence by topic

Evidence should identify system, version, scope, date or observation period, and limitations. Assess provider documentation for the service it covers and the responsibilities remaining with AMLOK and the customer.

​

Agreements and onboarding

Record instructions, confidentiality, permitted providers and locations, incident coordination, rights assistance, retention, return or deletion, review rights, and exit support in the agreement. Before production processing, establish responsible contacts and approval for source access, configuration, model use, and consequential actions. Agree the handling of material changes and unresolved exceptions.

​

Security materials under NDA

AMLOK can provide available security assurance materials under a signed nondisclosure agreement (NDA), including applicable service-provider SOC reports, control mappings, security policies, and supporting due-diligence documentation. Access is subject to the document owner’s distribution permissions and the scope of your review. Each report identifies the organization and service it covers, its assessment period, and any scope limitations. Provider reports support assessment of the covered dependency alongside AMLOK’s own controls and operating evidence.

​

Requesting materials

Contact privacy@amlok.io or your AMLOK business contact to define scope, complete the NDA, and request the required materials. Sensitive architecture, test results, provider details, and operating evidence are shared through an agreed secure channel with appropriate access restrictions. See Canadian requirements for institutional oversight and platform security for service controls.