Who is responsible for what
The institution (the bank, payment provider, mobile money operator or fintech) is the data controller for the data it monitors. It decides what is sent to SpeculaPro, which rules run, who has access and how long data is kept.
| Deployment | Our role |
|---|---|
| Hosted (SaaS) | Spalce Technologies Ltd is a data processor. We operate the service and process the data only on the institution’s instructions, under the data processing terms of our agreement. |
| Self-hosted | The software runs on the institution’s own systems. We hold none of its data and have no access to it. We supply the software, updates and support. |
What data the product holds
- Customers: names, identifiers such as national ID numbers, phone numbers, emails, addresses, risk ratings.
- Accounts and transactions: account identifiers, amounts, counterparties, channels, times, and account events such as sign-ins and SIM swaps.
- Compliance records: alerts, cases, notes, evidence, screening matches and regulatory reports.
- The institution’s staff: names, work emails, roles and a record of what each person did.
The institution sends only what its monitoring needs. SpeculaPro keeps its own copy of what it evaluates, so that every alert can be proven later.
Why it may be processed
Institutions monitor transactions because the law requires it: in Ghana, the Anti-Money Laundering Act, 2020 (Act 1044) and the directives of the Bank of Ghana and the Financial Intelligence Centre, and the equivalent laws in each other market. Data protection laws, including Ghana’s Data Protection Act, 2012 (Act 843), allow processing that is necessary to meet a legal obligation. Each institution confirms the legal basis for its own processing; we support it with the controls below.
Where the data lives
- Self-hosted: inside the institution’s own data centre or cloud account. Nothing leaves its network unless it configures that.
- Hosted: each institution’s workspace is pinned to one region, named in the agreement. No other region serves it, and we do not move it without the institution’s agreement.
Where a regulator requires data to stay in the country, self-hosting meets that requirement by design.
Keeping institutions apart
On the hosted service, every record carries the institution it belongs to, and the database itself (PostgreSQL row-level security) filters every query by institution. A fault in the application cannot return another institution’s rows. Personal data is encrypted with a separate key for each institution.
Protecting personal data
- Encrypted fields. National ID numbers, phone numbers, emails and account identifiers are encrypted with AES-256-GCM, with keys derived from master keys that can be rotated.
- Matching without revealing. To find the same identifier on two customers, the product compares keyed fingerprints, not the values themselves. A stolen copy of the database cannot be used to look up a phone number.
- Encrypted in transit. Connections to the service use TLS.
- Notifications carry references only. Emails, SMS and WhatsApp messages name a case or alert number, never a customer or a transaction.
More detail is on the Security page.
Who can see it
- Roles. Each person has a role that limits what they can do. Personal data is shown in clear only to roles granted that permission; everyone else sees masked values.
- Strong sign-in. Authenticator-app codes are on by default, and institutions can require single sign-on through their own identity provider.
- Four-eyes controls. Rule changes, case closures, report filings and sensitive administration can require a second person’s approval. Nobody approves their own change.
- An audit log. Configuration changes, case actions and access are recorded and cannot be edited or deleted.
Access by our own staff
On the hosted service, our staff operate the platform without reading an institution’s data. A member of our support team can look inside a workspace only after someone the institution has authorised approves a request. That access is read-only and time-limited, the institution can end it at once, and every page viewed is written to the institution’s own audit log. It never shows which accounts have been reported.
On a self-hosted installation we have no access at all.
Retention and deletion
- Set by the institution for each kind of data, never below the minimum period its anti-money laundering law requires records to be kept.
- Deleted when the period ends, automatically, unless a legal hold applies.
- Legal holds keep specific records beyond their period for an investigation or a court order, with a recorded reason.
- At the end of an agreement, the institution’s data is returned or deleted as the agreement provides, and its regulatory reports can be exported first.
Requests from individuals
People have the right to ask an institution what it holds about them and to have it corrected. SpeculaPro gives the institution’s data protection officer a place to record each request, track it against its legal deadline, gather the data concerned and record the answer.
If an individual writes to us directly about data an institution holds, we pass the request to that institution; it is theirs to answer.
Tipping-off
Anti-money laundering law forbids telling a person that they are, or have been, the subject of a suspicious transaction report. The product is built around that rule: answers to data subject requests leave out reports and the investigations behind them, notifications never name a customer, and support access by our staff cannot reveal which accounts were reported.
Breaches
The product includes a breach register in which the institution records an incident, who is affected, and the deadlines for notifying its regulator and the individuals concerned.
On the hosted service, if we become aware of a breach affecting an institution’s data, we tell that institution without undue delay, with what we know about its cause and extent, so that it can meet its own notification duties.
Service providers
On the hosted service we use a small number of providers for infrastructure and for delivering notifications. They are bound by confidentiality and data protection terms, and the list that applies to an institution is given with its agreement and on request. We tell institutions before adding a provider that would handle their data.
The product makes no calls to outside services with customer data unless the institution turns such a connection on, for example a sanctions data supplier of its choosing.
Regulators and auditors
Every alert and decision records the rule version, the data and the parameters used, so an institution can show a regulator exactly why a transaction was or was not flagged. An auditor role gives read-only access to alerts, cases, rules and the audit log.
We answer security and data protection questionnaires plainly, and we do not claim certifications we do not hold. Regulators and institutions with questions about this page are welcome to write to us.
Contact
Spalce Technologies Ltd, Princess Road, Omanjor, Accra, Ghana. Email: [email protected]. Phone: +233 55 811 4862.