Data residency
Self-host SpeculaPro inside your own data centre, so customer data never leaves your network. Or use SaaS, where your workspace is pinned to one region and no other region will serve it.
Security
Built like a vault, because it holds one.
A monitoring system knows who your customers are, where their money goes and which of them are under suspicion. Every layer of SpeculaPro is designed on the assumption that this data must never leak, and that every decision must be provable.
Protecting the data
Defence in depth, starting with where data lives.
Isolation in the database
On SaaS, every table carries the institution it belongs to and PostgreSQL row-level security filters every query. Even a bug in the application can’t return another institution’s rows.
Encrypted personal data
National ID numbers, phone numbers, emails and account identifiers are encrypted with AES-256-GCM, using a separate key for every institution, derived from master keys that can be rotated.
Matching without revealing
To find the same Ghana Card on two customers, SpeculaPro compares keyed fingerprints (HMAC-SHA256 blind indexes), not the numbers themselves. A stolen database copy can’t be used to guess phone numbers.
Need to see
Personal data is shown in clear only to roles granted that permission, for example to file a report. Everyone else sees masked values.
Append-only evidence
Approved rule versions are frozen, case timelines can’t be edited or deleted, and an audit log records configuration changes, case actions and access.
Access
Signing in is deliberately hard to fake.
People and systems authenticate differently, and both are designed to survive a leaked database.
People
- Authenticator-app codes on by default. A stolen password alone isn’t enough. Each code works once.
- Passwords hashed with argon2id, an algorithm designed to make guessing slow and expensive.
- Rate limits and lockouts against guessing, with the same error for every failure so attackers learn nothing.
- Short, revocable sessions. Signed out after 30 minutes idle and 12 hours at most by default; changing your password signs out every other session.
- Single sign-on with OIDC or SAML, with your identity provider’s multi-factor and break-glass administrators if it fails. SCIM provisioning creates accounts and deactivates leavers from your identity provider, ending their sessions at once.
- Data protection built in. Retention per kind of data within each law’s AML minimum, legal holds, data subject requests with their legal deadlines and a tipping-off safeguard, and a breach register with notification deadlines.
- Maker-checker for administration. Role grants, API keys, webhooks, single sign-on and the decision policy can require a second person’s approval; nobody approves their own change, and every request is kept for audit.
- Support access only when you approve it. On the hosted service, our support staff can look inside your workspace only after someone you have authorised approves a request. The access is read-only and time-limited, you can revoke it at once, and every read is in your audit log.
Systems
- API keys with scopes: one to send data, one to request decisions. A key can do nothing else.
- Shown once, stored as a fingerprint. SpeculaPro can’t reveal a key after it’s created, even to its own operators.
- Revocable at any time, taking effect on every server within 5 seconds.
- Mutual TLS and signed requests for ingestion. Planned
Controls
Four eyes, enforced by the database.
Most systems ask staff to follow a maker-checker process. SpeculaPro makes the database refuse anything else, so the control holds even against a mistaken script or an over-privileged administrator.
| Action | Done by | Must be confirmed by |
|---|---|---|
| Rule change | Rule author | A different approver |
| Suppression | Analyst | A different approver, usually the MLRO |
| Closing a high-risk case | Analyst | A second approver, when the policy requires it |
| Regulatory report | Author | A different approver |
Transparency
What we say, and what we don’t.
This page describes how the platform is built today; the one item not yet available is marked planned. We don’t claim certifications we don’t hold. If your security team or your regulator has a questionnaire, send it to us. We’ll answer it plainly.
Next step
Bring your security team.
We’ll go through data flows, encryption, key management and hosting options with the people who will sign off on them.