SentryFoxby Altiras
Design a controlled pilot

Trust & security

What a diligence review will find.

A sponsor who likes the product routes it into information security, legal, vendor management and operations. This page is written for that review rather than for the meeting before it, which means it states the 3 items not started and the 8 a reviewer would have to ask us for.

Technical boundary

What the platform can and cannot touch. These are architectural rather than procedural, which is why they are stated first — a control that depends on a process being followed is a weaker claim than one the schema cannot express.

Cardholder data
Never reaches the application. Card entry is hosted fields served by the acquirer's gateway, and nothing in the schema can represent a card number.
In place
Funds
No custody at any point. Settlement is between the processor, the acquirer and the merchant.
In place
Approval authority
No approval path exists in the product. The institution underwrites and decides; SentryFox applies the rules it was given.
In place
Audit log
Append-only. No update or delete path for any role, including roles that can halt a program.
In place
Encryption
In transit and at rest.
In place
Access control
Row-level, resolved on institution, organization and role rather than at the screen.
In progress

Security programme

Where the company is in the work an institutional vendor review expects. Three of these have not started.

PCI DSS scope
Scope assessment pending. The expected finding is that hosted fields keep the application out of scope for cardholder data, but that is an expectation until assessed.
In progress
SOC 2
Readiness programme not started.
Not started
Penetration test
Not yet commissioned.
Not started
Authentication
Multi-factor required for institutional and channel roles.
In progress
Incident response
Process drafted, not exercised.
In progress
Business continuity and recovery
Point-in-time recovery not yet enabled.
In progress
Subprocessor inventory
Maintained. Publication to this page outstanding.
In progress
Penetration test report availability
Under NDA once a test exists.
Not started

Data and privacy

What is held, for how long, and who can reach it.

Merchant and participant data
Held for the life of the program plus the institution's retention schedule.
In progress
Retention schedule
Set by the sponsoring institution per program rather than by the vendor.
In progress
Evidence captures
Immutable once written, hashed, and bound to the decision or finding they support.
In place
Channel partition
Designed and not yet independently verified. A channel is asked to trust a boundary it can test; until verification, it is a design claim.
In progress
Data residency
Region of processing and any restriction the institution requires.
Outstanding
Privacy notice and DPA
Standard form for institutional counsel to review.
Outstanding

Company

What a vendor-management review asks before anything technical. These rows are blank on purpose: they are facts only the company can supply, and filling them with something plausible is the fastest way to fail the diligence it is meant to pass.

Legal entity and registered address
Registered name, jurisdiction and address.
Outstanding
Operating history
Date of formation and the programmes operated to date.
Outstanding
Leadership
Named principals and verifiable background in payments and regulated commerce.
Outstanding
Relationship to Altiras Pay
Ownership, governance, commercial model, and whether SentryFox can be licensed independently of the sales organization.
Outstanding
Insurance
Technology E&O and cyber cover carried by the company itself — distinct from the coverage question on the Protect page.
Outstanding
Diligence contact
A named route for security and legal questionnaires.
Outstanding

Send the questionnaire

Security and vendor-management questionnaires are answered against this page, not around it. Where a row above reads not started, the questionnaire will say so too — a vendor that answers differently in a document than on its own site is the one diligence slows down.

Or review the integration architecture
Email programs@sentryfox.net

Include the review stage you are at and we will answer at that level rather than sending a brochure.