> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Compliance

> Security controls, privacy practices, and regulatory considerations for AMLOK Insights and AMLOK Signal.

AMLOK maintains security controls, privacy and data-handling policies, and incident-response procedures to protect borrower information and support accountable processing. The program covers Insights, Signal, their integrations, and the infrastructure and providers involved in processing data.

AMLOK is built with controls aligned to the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 security-management principles. Read our [standards and control alignment](https://docs.amlok.io/security/standards.md) for our security frameworks and financial-sector control focus.

Agree the processing scope, security requirements, permitted locations, retention schedule, and responsibilities before connecting live borrower data.

> **[Standards and control alignment](https://docs.amlok.io/security/standards.md)**
>
> SOC 2, ISO/IEC 27001, and financial-sector security expectations.

> **[Hosting and subprocessors](https://docs.amlok.io/security/hosting-and-subprocessors.md)**
>
> Data locations, service categories, and supplier oversight.

> **[Platform security](https://docs.amlok.io/security/platform-security.md)**
>
> Access, encryption, tenant separation, secure development, and monitoring.

> **[Privacy and data handling](https://docs.amlok.io/security/privacy.md)**
>
> Source permissions, sensitive information, retention, and individual requests.

> **[Canadian requirements](https://docs.amlok.io/security/canada.md)**
>
> PIPEDA, provincial privacy laws, OSFI guidance, and financial-sector scope.

> **[United States requirements](https://docs.amlok.io/security/united-states.md)**
>
> Financial safeguards, lending decisions, consumer reporting, and state privacy.

Security policies, applicable service-provider SOC reports, and supporting assurance materials are available for scoped review [under NDA](https://docs.amlok.io/security/due-diligence.md#security-materials-under-nda), subject to availability and distribution permissions.

## Shared responsibilities

| Area | AMLOK responsibilities | Customer responsibilities |
| - | - | - |
| Data processing | Process agreed information for authorized workflows. | Establish collection authority, notices, source permissions, and permitted purposes. |
| Access | Protect service and tenant boundaries. | Approve users, protect credentials, and remove unnecessary access. |
| Underwriting and monitoring | Process information within the agreed scope and protect workflow records. | Set lending policy, approve model use, review exceptions, and own decisions and notices. |
| Privacy and incidents | Maintain data-handling, investigation, and escalation procedures. | Identify applicable obligations and coordinate requests, notifications, and retention. |

The signed agreement and applicable law determine each party's obligations. A software integration does not transfer a lender's regulatory accountability to its provider.

## Plan your review

Start with [due diligence](https://docs.amlok.io/security/due-diligence.md). Review [hosting and subprocessors](https://docs.amlok.io/security/hosting-and-subprocessors.md), [incident response](https://docs.amlok.io/security/incident-response.md), and [AI and model governance](https://docs.amlok.io/security/ai-governance.md).

The regulatory guides focus on Canada and the United States. Requirements depend on the institution, product, jurisdiction, data, and actual activity. Review that scope with your legal and compliance teams.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.