SECURITY & TRUST

How your compliance data is protected

This page is what a broker's compliance officer or an auditor needs before switching KYTGate on: where the data is, who can reach it, how tenants are kept apart, what is cryptographically signed and what is merely logged. It also says what we have not done yet. Ask us anything at hello@kytgate.com.

Where data lives

ApplicationVercel (serverless functions, TLS 1.2+ everywhere, no long-lived servers to patch).
DatabaseNeon managed Postgres, region US East (AWS us-east-1). Encrypted at rest and in transit; point-in-time restore per the Neon plan. One database, tenant isolation by row-level tenant id on every table.
E-mailResend, only for wallet-watch confirmations and change alerts. No marketing mail exists.
Blockchain readsPublic RPC endpoints per network and TronGrid for Tron. A read contains the address or transaction being checked — nothing about the tenant or its customer.
Sanctions listsFetched daily from OFAC, UK OFSI and the EU; stored as content-hashed snapshots so any decision can name the exact list version it used.
SecretsVercel encrypted environment variables (sensitive mode). The receipt signing key never leaves the runtime; its public half is published at /api/v1/receipt-key.

Tenant isolation

Every table carries a tenant id and every query is scoped by the API key that made the request; the key resolves to exactly one tenant and cannot be pointed elsewhere. Idempotency keys, processor signals, wallets, cases, reports and replays are all tenant-scoped. We do not trust that by inspection: the console runs an isolation audit against the live API — two sandbox tenants, one seeded, every endpoint called with the other's key against the first's identifiers, plus no-key and garbage-key probes. Last run: 28 probes, 0 leaks. Any customer can ask for the latest run's output.

Access control

APIBearer keys, stored as SHA-256 hashes (the plaintext is shown once at creation). Revocation is immediate; keys never expire silently.
ConsoleNamed user accounts with scrypt-hashed passwords, 12-hour sessions in httpOnly cookies, roles admin / reviewer enforced on every page and every action, login throttling (10 attempts per e-mail, 30 per IP, 15 minutes).
Four-eyesA BLOCK_PENDING_MLRO case cannot be closed by one person; the proposer and the approver must be different accounts, and the approver cannot alter the proposed outcome.
Break-glassAn operator secret exists for emergencies; every use is written to the audit log as actor 'break-glass'.
Audit logAppend-only. Every console mutation, mode switch, key creation, policy activation, override, export, retention purge and isolation run — who, how, from where, on what.

Integrity and evidence

Every screening produces a Decision Receipt signed with Ed25519 over a canonical JSON of its inputs, list snapshot hashes, coverage, signals, policy version and decision. Anyone can verify a receipt in their browser at /tools/receipt-verifier without an account and without trusting us. Policies are immutable versions; built-in baselines are frozen by version so a decision from March can be replayed under March's rules in December. Webhooks are HMAC-SHA256 signed with a per-tenant secret and a timestamp.

Data minimisation

The public site sets no cookies and runs no analytics. Free tool queries are never stored (only a hashed-IP hourly counter). Wallet watch stores an address and an e-mail only after a confirmation click, and deletes the record 30 days after the person stops it. Tenant data is deleted on the tenant's retention schedule (default 7 years, legal hold available) and 30 days after a tenant closes; a full JSON export is available before that. See the privacy policy.

Availability and incidents

Fail-closed by design: if a mandatory source (sanctions snapshot older than the tenant's limit, transaction verification) cannot answer, the decision is TECHNICAL_HOLD, never ALLOW. The daily job reports each step and the console shows a red banner when lists are stale. Security incidents affecting a tenant's data are notified to that tenant without undue delay and within 48 hours of confirmation, with what happened, what data, and what we did.

What we have not done yet

No SOC 2 or ISO 27001 certification. No third-party penetration test yet (planned before commercial launch; the isolation audit is our own). No SSO/SAML (planned for the enterprise tier). Single-region database. We would rather say this here than have you find out in a questionnaire.

Documents

Data Processing Addendum (template) · Terms · Privacy · API documentation.

Last updated: 5 September 2026.