The questions your legal team will ask first

Calmony screens against OFSI (UK), EU, UN, and OFAC sanctions lists. The nightly sync pulls the latest OFSI CSV directly from gov.uk, validates the discovered URL against a permitted domain allowlist, and imports entities automatically — so your screening runs against current data, not last week's.

No. Once a person is added to your account, Calmony's batch rescreening engine re-screens every monitored individual automatically each night after the sanctions lists update. You only need to act when a new match appears in your Match Review queue. The dashboard surfaces pending matches distinctly from clear results, so an empty list means clear — not a failed load.

The platform uses AES-256-GCM encryption for PII fields including names, dates of birth, and nationality. Authentication is handled via OAuth providers (Google, GitHub, Microsoft Entra ID) with no passwords stored. All API endpoints sit behind rate limiting infrastructure, and a full audit log tracks every write operation — including who created, updated, or deleted a record and when. Read access to sensitive records is also logged. GDPR deletion requests are handled through a dedicated endpoint that anonymises records across all relevant tables.

Yes. A REST API is available under /api/v1/ designed for server-to-server integrations. API keys can be created and revoked from the Settings page. Input is validated with strict schemas — unrecognised or malformed payloads are rejected with a 400 before they touch the database. Full API documentation is available inside the dashboard. For specifics on rate limits and payload formats, details are available on request.

The codebase is built against ISO 27001, SOC 2, GDPR, and HIPAA controls — covering areas including access control and RBAC, audit logging, data retention policy documentation, lawful basis documentation (published at /lawful-basis), CORS configuration, security headers, and session management. Retention periods for screening records, billing data, and usage analytics are documented in the privacy policy. Where automated enforcement of those periods is not yet in place, that is on the roadmap. If you need a specific control evidenced for a vendor assessment, contact us.

The nightly sync validates each discovered CSV URL before fetching, falls back to known-good fallback URLs if the primary source is unavailable, and writes a versioned sync log entry on completion. A /api/health endpoint returns the current system status. Alerting infrastructure for sync failures is on the active development roadmap; current failure details are captured in logs. For SLA specifics, details are available on request.