Security & Compliance

AMLOK maintains security controls, privacy and data-handling policies, and incident-response procedures to protect borrower information and support accountable processing. The program covers Insights, Signal, their integrations, and the infrastructure and providers involved in processing data. AMLOK is built with controls aligned to the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 security-management principles. Read our standards and control alignment for our security frameworks and financial-sector control focus. Agree the processing scope, security requirements, permitted locations, retention schedule, and responsibilities before connecting live borrower data.

Standards and control alignment

SOC 2, ISO/IEC 27001, and financial-sector security expectations.

Hosting and subprocessors

Data locations, service categories, and supplier oversight.

Platform security

Access, encryption, tenant separation, secure development, and monitoring.

Privacy and data handling

Source permissions, sensitive information, retention, and individual requests.

Canadian requirements

PIPEDA, provincial privacy laws, OSFI guidance, and financial-sector scope.

United States requirements

Financial safeguards, lending decisions, consumer reporting, and state privacy.

Security policies, applicable service-provider SOC reports, and supporting assurance materials are available for scoped review under NDA, subject to availability and distribution permissions.

Shared responsibilities

Area	AMLOK responsibilities	Customer responsibilities
Data processing	Process agreed information for authorized workflows.	Establish collection authority, notices, source permissions, and permitted purposes.
Access	Protect service and tenant boundaries.	Approve users, protect credentials, and remove unnecessary access.
Underwriting and monitoring	Process information within the agreed scope and protect workflow records.	Set lending policy, approve model use, review exceptions, and own decisions and notices.
Privacy and incidents	Maintain data-handling, investigation, and escalation procedures.	Identify applicable obligations and coordinate requests, notifications, and retention.

The signed agreement and applicable law determine each party’s obligations. A software integration does not transfer a lender’s regulatory accountability to its provider.

Plan your review

Start with due diligence. Review hosting and subprocessors, incident response, and AI and model governance. The regulatory guides focus on Canada and the United States. Requirements depend on the institution, product, jurisdiction, data, and actual activity. Review that scope with your legal and compliance teams.

Overview

Integrations

Data Model

Pricing

Support