Trust center

Security, privacy, and procurement evidence

This is the canonical starting point for security and compliance questions. It explains how Chequedb is deployed, which controls to verify, and how to request the current evidence package for your entity and deployment.

Request the security package Review on-prem architecture

How to read certification language on this site

Certification status, report scope, and audit period depend on the legal entity and deployment. We do not ask buyers to infer certification from a logo or a deployment model. Where a page says “ready” or “compatible”, that describes control alignment, not a certification. Request the current report, scope, auditor, and bridge letter for the exact entity you are evaluating.

If an older page differs, this page and the procurement evidence take precedence.

Controls to verify

These are the control areas a bank security review should see evidence for. The list is not a certification claim; it is the scope of the conversation.

Deployment choice

Cloud, private environment, and on-premise options. The security package documents the data flow and trust boundaries for the chosen deployment.

Identity and access

Role-based access, least privilege, maker-checker separation, and customer-controlled identity where the deployment supports SSO.

Encryption

TLS in transit and encryption at rest. Key-management and rotation details are confirmed for the deployment model.

Audit logging

Access, review, approval, export, and administrative events are recorded so the customer can reconstruct who did what and when.

Retention and deletion

Configurable retention, legal hold, backup handling, and deletion verification are documented in the security package.

Vulnerability management

Dependency and vulnerability tracking, remediation SLAs, and independent penetration testing are scoped during procurement.

What the security package includes

  • Architecture and data-flow diagram for the proposed deployment
  • Current SOC 2 report, scope, auditor, and bridge letter where held
  • Penetration-test summary and remediation status
  • DPA, subprocessor list, and data-residency terms
  • Retention, legal hold, backup, and deletion procedures
  • Business continuity and disaster-recovery summary
  • Security questionnaire responses and deployment-specific control evidence

Availability depends on the entity, deployment, and whether an NDA is in place. This page does not assert that every artifact exists for every deployment.

Procurement path

  1. 1. NDA and scope. Confirm the legal entity, deployment, data types, and volume.
  2. 2. Evidence pack. We share the current security package for that scope.
  3. 3. Review. Your security, legal, and operations teams review the controls and gaps.
  4. 4. Pilot. Test with de-identified images and the agreed integration boundary.
  5. 5. Contract. DPA, SLA, support, retention, and incident terms are agreed before production.
Start the security review

Report a vulnerability

Email support@chequedb.com with the subject “Security report” and enough detail to reproduce the issue. Do not include production cheque images or personal data in the initial report. We will agree a secure transfer method.

Related pages

On-prem security & architectureDeveloper documentationService statusPrivacy policyTerms of serviceContact

Security and compliance questions

Is Chequedb SOC 2 Type II certified?

Certification status, report scope, and audit period depend on the legal entity and deployment. We do not ask buyers to infer certification from a logo or a deployment model. Request the current security package for the exact scope; where a report is held, it is provided under NDA through procurement.

What does “SOC 2 ready” or “ISO 27001 compatible” mean?

Those phrases describe control alignment, not a certification. They mean the product can operate within a customer’s audited control environment. They are not a substitute for the current report, scope, auditor, and bridge letter.

What security evidence can we request?

Architecture and data-flow diagrams, the current SOC 2 report and scope where held, a penetration-test summary, DPA and subprocessor list, retention and deletion policy, business continuity and disaster recovery summary, security questionnaire responses, and deployment-specific control evidence.

Does on-premise deployment make us compliant?

No. On-premise is a deployment model, not a certification. Compliance depends on the full control environment, evidence, policies, audit scope, and the customer’s own obligations. The on-premise security page explains the control areas to verify.

How do you handle data retention and deletion?

Retention is configured for the deployment and customer policy. The security package documents retention, legal hold, backup copies, and deletion verification. Confirm the exact terms for your deployment before sending production images.

How do I report a security issue?

Email support@chequedb.com with the subject “Security report” and enough detail to reproduce the issue. Do not include production cheque images or personal data in the initial report. We will acknowledge and agree a secure transfer method.

This page is a procurement starting point, not a certification or legal advice. The current control set, reports, and contractual commitments are confirmed for the specific entity and deployment.