Security
Security of verification services
Identity and business verification services used in Trancher are delivered through enterprise-grade infrastructure built for regulated environments. The underlying platform holds ISO/IEC 27001 certification and applies FIPS 140-aligned cryptographic controls so sensitive identity data is protected to the standard expected by financial institutions and other reporting entities.
-
ISO 27001 / FIPS 140 aligned verification services
Hosted on AWS in Sydney (ap-southeast-2)
Most firms are operational within weeks
01
Verification-service controls
Identity and business verification services are delivered with enterprise-grade security controls aligned to ISO/IEC 27001 information security management and FIPS 140 cryptographic standards for the protection of sensitive identity data.
The verification platform holds ISO/IEC 27001 certification following an independent audit. Encryption across the platform is FIPS 140-compliant, with AES-256 encryption applied to data at rest and in transit. These controls sit inside a broader security architecture designed for regulated financial-services workloads, including access boundaries, audit logging and continuous monitoring.
02
Data hosting
Verification and identity data is processed and stored on AWS infrastructure purpose-configured for regulated financial-services workloads. The platform is an AWS Partner and operates with data-residency controls, privacy-by-design architecture, and retention policies built to meet the obligations of reporting entities.
Client and identity data used for verification is held in a dedicated compliance data store rather than general-purpose systems. Backups and recovery arrangements follow the platform’s ISO 27001-aligned information security management system. Exact residency options can be confirmed during onboarding if your firm has specific location requirements.
03
How KYC/KYB data is handled
When you run a verification check, the data required for that check (identity details, beneficial-owner information, screening results) is collected and processed only for the purpose of completing the verification and supporting your AML/CTF records.
Access is controlled so only authorised users and systems can view sensitive fields. The platform maintains an audit trail of access and actions. Data is retained for as long as your firm’s program and regulatory obligations require (commonly up to seven years for AML/CTF records), then deleted or anonymised according to the configured retention and deletion workflows. You remain the controller of your client relationship; the verification platform acts as the processor for the specific checks you initiate.
Important – KYC / KYB transaction disclaimer
Every verification check triggers one transaction. If you are identifying individuals within an entity (for example directors, beneficial owners or authorised persons), each individual check is a separate transaction and is charged accordingly.
Security questions
For security, privacy or data-handling questions about verification services, contact us at security@trancher.global or via the General enquiry form. Please include your firm name, a short description of the query, and any relevant client or check reference so we can route it promptly.
Ready to simplify compliance?
Book a short overview or speak with our in-house specialists about the right path for your firm.