Security
Consul holds your clients' files and your AML records, so this page says plainly how they are protected and what we do not yet have. Questions or a security report: [email protected].
Where your data lives
Consul runs on a dedicated server we control in Helsinki, Finland (EU). Cloudflare sits in front of it, and the server only accepts traffic that comes through Cloudflare.
Each firm is walled off
Every firm is its own tenant. Every record is tagged to its firm, and every request is checked against the firm of the person signed in. One firm can never read another firm's records.
Backups
The database is backed up every night. Backups are encrypted before they leave the server and are kept off-site, so the service can be restored if the server is lost.
Signing in and access
- Passwords are stored only as salted hashes. Common and guessable passwords are refused.
- Sign-in attempts are rate-limited. You can sign in with Google instead of a password.
- Sessions are re-checked on every request and end at once when a person is removed, suspended or resets their password.
- Each team member has a role, and the server enforces what that role may do.
- Operator actions on a firm are logged.
AI and outside services
AI features use Anthropic's models under commercial terms: what you send is not used to train their models. Nothing you add to Consul trains any model or reaches another firm. The outside services we use, and what each receives, are listed in the privacy policy.
Records and deletion
Checks are kept as AML records for 5 years and can be downloaded at any time. Selfies and videos from identity checks are deleted within 24 hours.
Certifications
We do not hold SOC 2 or ISO 27001 certification yet. We will say here when that work starts.
Data processing agreement
A data processing agreement is available on request from [email protected].