How Sanctix protects your data
A straight answer to the questions a compliance or security team asks before signing off on a sanctions-screening vendor. If something below isn't enough detail for your procurement process, email us — we'd rather have that conversation directly than leave you guessing.
Sanctix is not yet SOC 2 certified. We'd rather tell you where we actually are on that path than imply a certification we don't hold — see the compliance roadmap below.
Data protection
All traffic to Sanctix is served over TLS. Screening data and reports are stored in a managed Postgres database with encryption at rest, provided by our infrastructure provider.
Every API request requires a JWT session or a scoped API key. Keys can be revoked individually without affecting the rest of your workspace.
Per-key and per-user rate limits protect against runaway automation and credential abuse across every screening endpoint.
API requests are logged with the calling user or API key, endpoint, status and time. Screenings, team changes, monitors and webhooks are recorded in each workspace's activity log. Saved reports carry a SHA-256 fingerprint.
Data residency & cross-border transfer
The database (Supabase) and the screening API (Railway, Amsterdam) run in the European Union. The website and dashboard are served by Vercel. Optional AI summaries and document screening send limited data to the AI provider Sanctix has selected. The full provider list and what each receives is in our Privacy Policy.
Compliance roadmap
Need a specific attestation for procurement before something above is live? Tell us your timeline — we prioritize this roadmap based on real deal requirements, not guesswork.
Infrastructure & sub-processors
Sanctix runs on managed infrastructure for application hosting and database storage, and uses Polar.sh as merchant of record for billing. We don't sell screening data or use it to train public AI models — see our Privacy Policy for the full sub-processor list and data handling terms.
Report a vulnerability
Found a security issue? Email security@sanctix.io with details and reproduction steps. We aim to acknowledge reports within 2 business days.