Trust Center
Security your CISO can verify, not just read.
Our commitment to security, privacy and responsible AI is built into the engine, the agent and the way we ship. Browse our controls, then request the documents your review needs.
Documents
Public, under NDA, or in preparation.
Controls
What's in place, and what isn't yet.
✓ implemented · ◐ in progress · ○ planned
Data security
- ✓Encryption at rest (AES-256)
- ✓Encryption in transit (TLS 1.2+)
- ✓Logical tenant isolation per institution
- ✓Lead and borrower data owned by the bank
- ◐Data retention policy
Application security
- ✓OWASP Top 10 hardening
- ✓Web application firewall
- ✓Brute-force and form rate limiting
- ✓Session expiry, HttpOnly and Secure cookies
- ✓Security headers and TLS configuration hardened
- ✓Independent penetration test Data Protect · May 2025
AI governance
- ✓Agent never computes figures; the deterministic engine does
- ✓15-profile release gate, binary verdict
- ✓Mirror-mode model validation with cost cap
- ✓Per-module kill switch, allow-list loading
- ✓Full session traceability and replay
- ✓Human escalation on edge cases
- ◐AI disclosure on voice calls TCPA program
Access control
- ✓SSO (Keycloak · OAuth 2.0 / SAML)
- ✓Role-based access control
- ◐MFA on all privileged accounts
- ◐Periodic access reviews
Infrastructure
- ✓Containerized services (Docker)
- ✓Stateless, horizontally scaled app tier
- ◐In-region hosting per client requirements
- ◐Encrypted backups
Logging & monitoring
- ✓Access logging and audit trails
- ✓IP filtering
- ✓Continuous security monitoring
- ✓Versioned, audited configuration tables
Change management
- ✓CI-enforced architecture rules
- ✓Pre-commit hooks and static linters
- ✓Nightly engine contract tests
- ✓Instant, config-only rollback
Incident response & continuity
- ✓Security review workshop for client IT teams
- ◐Incident response plan, tested by simulation
- ◐Business continuity & disaster recovery plan
Privacy & compliance
- ◐CNDP (Morocco, law 09-08)
- ◐SOC 2 Type I audit
- ○SOC 2 Type II (after Type I)
- ◐TCPA program for AI voice
- ◐MISMO 3.6.2 certification
- ◐SR 26-2 vendor model-validation package
- ○ISO/IEC 27001
Subprocessors
Who touches the data.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting | Region per client |
| Google (Gemini) | LLM provider, behind a provider-agnostic layer | Per configuration |
| Salesforce | CRM for credit-desk deployments | Client instance |
| 3CX | Telephony for voice agents | Per deployment |
Draft list; the binding list is attached to each client's data-processing agreement.
Updates
Security changelog.
US compliance program launched: SOC 2, TCPA, MISMO 3.6.2, SR 26-2
Agentic AI in production with the 15-profile release gate and mirror-mode model validation
Independent penetration test by Data Protect for Bank of Africa: no critical findings
FAQ
The questions every security review asks.
Who makes the credit decision?
The lender, always. AFDAL does pricing, structuring and eligibility advisory and prepares the file; it does not underwrite.
Can the AI agent invent a rate or a payment?
No. Every figure comes from the deterministic engine through a versioned contract. If the engine is unavailable, the agent says so and offers the official simulation later.
Where is our data hosted?
In the region your deployment requires. Hosting and data-residency options are confirmed per client during the security review.
Is AFDAL SOC 2 certified?
Not yet. We are currently completing our SOC 2 Type I audit. Type II has not started: its six-month observation window opens once the Type I report is issued. Our completed audits and pentest are available under NDA today.
Can our team run its own security tests?
Yes. Every production deployment so far passed the client's own security review, and we run a technical workshop with your IT team on request.
How are model changes controlled?
Candidate models run in mirror mode on real traffic, log only, for 48–72 hours with a daily cost cap, then must pass the 15-profile bench. Swap and rollback are configuration changes.
AI governance
Six architecture rules, enforced by tooling.
read-onlyUntouchable business engineThe AI reads the engine through a contract; it cannot modify it. The agent never invents a number.
CI grep = 0No hardcoded modelModel routing lives in configuration. A CI search for provider names must return zero hits.
48–72hMirror-mode migrationCandidate models shadow real traffic, log-only, for 48–72h with a daily cost cap before any swap.
kill switchNo feature in the coreEvery capability is a module with an allow-list entry and a hot kill switch.
i18n @ bootNo hardcoded customer textAll customer-facing strings go through the language dictionary, verified at boot.
15/15No production without the benchThe pipeline refuses any build without a green 15-profile verdict.
Stack
Deliberately boring technology.
No exotic dependencies, no vendor lock-in. The defensibility lives in the engine and the data, not the framework.
| Layer | Components |
|---|---|
| Engine | Laravel API · Vue.js SPA · MongoDB · multi-tenant |
| Back office | Laravel · MySQL · Keycloak SSO · no-code admin |
| Agent runtime | Python (FastAPI) · event bus · Redis session store · SIP/RTP over WebSocket |
| LLM layer | Provider-agnostic abstraction · PROD / MIRROR / STANDBY states |
| Runtime | Docker · Portainer · stateless horizontal scaling |
| Hosting | AWS · in-region hosting per client data-residency requirements |
| Integrations | REST API · WebView · iFrame · OAuth/SAML · core banking, CRM, e-sign, KYC, Salesforce |
Observability
Any conversation, replayable in under a minute.
One session ID propagates through transcript, tool calls, model calls (tokens and cost), engine calls (request, response, latency), memory and lifecycle events. Audit-grade traceability for the bank, with no developer involved.
Activate AFDAL for your institution.
Choose your modules, get sandbox keys and an embed snippet in minutes. A deployment lead joins you for go-live.