Trust
Security and data handling
How SanctionsKit protects organization access, API credentials, private evidence, and screening data.
On this page
Access is tied to an organization
Human accounts use WorkOS AuthKit and server-side membership checks. API keys belong to one organization and environment, have explicit scopes, and can be revoked. Secrets are shown once and stored as verification material. Production keys belong in server configuration, not browser bundles or request URLs.
Tenant-aware database transactions and row-level security provide separate checks on access. Private uploads and downloads require application authorization. Knowing a file path or result identifier does not grant another organization access. Operator access requires an allowlisted account and a recorded reason.
Minimize data where it does not belong
Screening inputs are excluded from application logs, analytics events, and workflow arguments. Durable jobs carry internal references and load authorized records when they execute. Private pages and API results use private cache controls and indexing exclusions. Development and previews must use synthetic or sanitized data.
Retention differs by record type. Standard evidence defaults to 90 days, while one-time minimal retention avoids keeping the submitted subject and limits reduced results to 24 hours. Active monitoring necessarily retains subject information. Backups expire under the configured provider policy rather than an immediate per-row promise.
Security questions and independent assurance
Security controls include server-side membership checks, scoped API keys, database row-level policies, request validation, webhook signatures, and private destination restrictions. Security testing and independent certification are separate activities.
SanctionsKit does not claim a security certification, guaranteed uptime, completed independent penetration test, or established data-residency commitment. Send a security concern to support@sanctionskit.com with a short description and request identifiers where available. Do not include live credentials or unnecessary personal information.