Security and data handling

Sign in with an account in your organization. Before it grants access, the server checks that you belong to that organization. Each API key works for one organization and one environment. Its scopes limit what it can do. You can revoke it. SanctionsKit shows the secret once, then stores material used to verify it. Keep production keys in your server configuration. Never put them in browser code or request URLs.

Database transactions check which organization is making the request. Row-level security adds a separate access check in the database. Private uploads and downloads also require application authorization. Knowing a file path or result ID does not grant access to another organization’s data. Operators need an allowlisted account and must record a reason for access.

Upload original PDFs, images, and passport scans directly to your organization’s chosen document service, then link them from the SanctionsKit case. SanctionsKit stores the reference and reviewer assertions, not the original file. It does not upload, fetch, copy, or independently verify that file.

Owners and administrators add service names and approved HTTPS repository URLs in Settings → Organization documents. This allows links to those services. It does not connect accounts or grant upload access. Your organization manages access, security and retention for the original files. An approved service name or URL does not certify its security settings; a SanctionsKit case hold does not preserve the original there.

Screening inputs stay out of application logs, analytics events and workflow arguments. Background jobs carry internal references. They load the authorized records when they run. Private pages and API results use private cache controls and are excluded from indexing. Development and previews must use synthetic or sanitized data.

Retention depends on the record. New workspaces start with 10 calendar years of standard evidence retention. Existing workspaces keep their configured policy. Open standard review cases preserve available evidence until completion. A saved policy can also require a recorded relationship-end or business event before the retention clock starts.

Eligible individual API-key requests can use minimal retention. This omits the saved subject, keeps reduced results for 24 hours and creates no review case. It is unavailable when controls require retained review, external checks or an event-based retention trigger. Dashboard screenings, batches and monitoring use standard retention. Backups expire under the configured provider policy rather than an immediate per-row promise.