> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Standards and control alignment

> SOC 2 Trust Services Criteria, ISO/IEC 27001, and security practices for regulated financial institutions.

AMLOK is built with security controls aligned to the **AICPA Trust Services Criteria used in SOC 2 Type II examinations** and the information-security management principles of **ISO/IEC 27001:2022**. These frameworks inform how we protect financial information, manage access and suppliers, respond to incidents, and maintain accountable operations.

## SOC 2 control alignment

SOC 2 is an assurance reporting framework. A Type II examination evaluates control design and operating effectiveness over a specified period. Our control alignment focuses on the following outcomes; a customer's review should consider the specific service, controls, and operating evidence within its scope. See the [AICPA SOC resources](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services).

| Trust Services category | AMLOK control focus |
| - | - |
| Security | Least privilege, authenticated access, tenant separation, encryption, change control, vulnerability management, and incident response. |
| Availability | Monitoring, dependency management, backups, recovery procedures, and agreed service commitments. |
| Processing integrity | Source traceability, validation, reconciliation, exception handling, and controlled workflow execution. |
| Confidentiality | Purpose-limited access, protected transmission and storage, supplier restrictions, and retention and deletion procedures. |
| Privacy | Documented purposes, appropriate collection authority, data minimization, individual-rights assistance, and breach assessment. |

## ISO/IEC 27001 alignment

Our security program follows a risk-based approach to governance, information protection, and continual improvement. It includes policy ownership, risk assessment, access management, secure development, supplier oversight, incident handling, continuity, and review of corrective actions. [ISO/IEC 27001:2022](https://www.iso.org/standard/27001) provides the information-security management system framework for this approach.

## Security risk management

The [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework) provides a useful structure for reviewing these practices: Govern, Identify, Protect, Detect, Respond, and Recover. Use it to connect institutional risk requirements to the controls and evidence relevant to your AMLOK deployment.

## Financial-sector requirements

Technical safeguards support an institution's compliance program. Applicability depends on the institution's regulator, activities, jurisdiction, and the information processed.

| Area | Relevant requirements | How to scope the AMLOK review |
| - | - | - |
| Canadian privacy | PIPEDA, Alberta and British Columbia private-sector privacy laws, and Quebec's private-sector privacy law as amended by Law 25. | Collection authority, permitted purposes, sensitive information, retention, individual rights, breach response, and cross-border processing. |
| Canadian regulated institutions | OSFI third-party risk and technology/cyber risk guidance, where applicable to the customer. | Service materiality, oversight, contracts, security evidence, resilience, concentration risk, and exit planning. |
| US financial information | GLBA and the safeguards requirements applicable to the financial institution and its service providers. | Information security, access, encryption, supplier oversight, incident coordination, and contractual safeguards. |
| Lending and reporting | ECOA/Regulation B, FCRA where applicable, and relevant state requirements. | Data provenance, permissible use, model governance, human oversight, explanations, notices, and dispute handling. |
| AI and automated workflows | Applicable institutional model-risk, privacy, lending, and governance requirements. | Intended use, validation, limitations, change control, traceability, and authorized decision-making. |

Read the [Canadian](https://docs.amlok.io/security/canada.md), [Quebec](https://docs.amlok.io/security/quebec.md), [United States](https://docs.amlok.io/security/united-states.md), and [AI governance](https://docs.amlok.io/security/ai-governance.md) guides for applicability and primary regulatory sources.

Payment processing, identity verification, and banking integrations have their own scopes and provider obligations. Vendor assurance applies to the vendor's covered service; it does not automatically extend to every AMLOK workflow. Review any payment-card or other specialized requirements against the actual data flow.

## Review the evidence

Available assurance materials, including applicable service-provider SOC reports, can be requested [under NDA](https://docs.amlok.io/security/due-diligence.md#security-materials-under-nda). Start with [due diligence](https://docs.amlok.io/security/due-diligence.md) and [platform security](https://docs.amlok.io/security/platform-security.md). Define the system boundary, review period, controls, responsibilities, and supporting materials with AMLOK. For security and procurement questions, contact [privacy@amlok.io](mailto:privacy@amlok.io).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.