Which sanctions lists does Calmony screen against?

Calmony screens against OFSI (UK), EU, UN, and OFAC sanctions lists. The nightly sync pulls the latest OFSI CSV directly from gov.uk, validates the discovered URL against a permitted domain allowlist, and imports entities automatically — so your screening runs against current data, not last week's.

How does continuous monitoring actually work — do I have to re-upload my people list every day?

No. Once a person is added to your account, Calmony's batch rescreening engine re-screens every monitored individual automatically each night after the sanctions lists update. You only need to act when a new match appears in your Match Review queue. The dashboard surfaces pending matches distinctly from clear results, so an empty list means clear — not a failed load.

How is our data protected? We're handling sensitive PII on third parties.

The platform uses AES-256-GCM encryption for PII fields including names, dates of birth, and nationality. Authentication is handled via OAuth providers (Google, GitHub, Microsoft Entra ID) with no passwords stored. All API endpoints sit behind rate limiting infrastructure, and a full audit log tracks every write operation — including who created, updated, or deleted a record and when. Read access to sensitive records is also logged. GDPR deletion requests are handled through a dedicated endpoint that anonymises records across all relevant tables.

Can we integrate Calmony into our own onboarding or CRM workflow via API?

Yes. A REST API is available under /api/v1/ designed for server-to-server integrations. API keys can be created and revoked from the Settings page. Input is validated with strict schemas — unrecognised or malformed payloads are rejected with a 400 before they touch the database. Full API documentation is available inside the dashboard. For specifics on rate limits and payload formats, details are available on request.

What compliance frameworks does the platform itself adhere to?

The codebase is built against ISO 27001, SOC 2, GDPR, and HIPAA controls — covering areas including access control and RBAC, audit logging, data retention policy documentation, lawful basis documentation (published at /lawful-basis), CORS configuration, security headers, and session management. Retention periods for screening records, billing data, and usage analytics are documented in the privacy policy. Where automated enforcement of those periods is not yet in place, that is on the roadmap. If you need a specific control evidenced for a vendor assessment, contact us.

What happens if a sanctions list update fails overnight — will we know about it?

The nightly sync validates each discovered CSV URL before fetching, falls back to known-good fallback URLs if the primary source is unavailable, and writes a versioned sync log entry on completion. A /api/health endpoint returns the current system status. Alerting infrastructure for sync failures is on the active development roadmap; current failure details are captured in logs. For SLA specifics, details are available on request.

Security & Compliance — Calmony Sanctions Monitor

SECURITY & COMPLIANCE

Built to protect sensitive compliance data

Calmony Sanctions Monitor is engineered with encryption, audit logging, access controls, and GDPR compliance at every layer — because the data you screen is too important to leave to chance.

[ DATA PROTECTION / AT REST ]

AES-256-GCM encryption for every PII field

Every personally identifiable field — names, dates of birth, nationalities — is encrypted with AES-256-GCM before it touches the database. The encryption module uses PBKDF2 key derivation with per-domain context strings, so different data types are cryptographically isolated from one another.

AES-256-GCM authenticated encryption for PII at rest
PBKDF2 key derivation with per-domain context isolation
Production enforcement: ENCRYPTION_SECRET required to start
Neon Postgres with encrypted storage at infrastructure layer

Calmony sanctions monitoring dashboard showing screening overview

[ AUTHENTICATION / ACCESS ]

Authentication built on proven standards

Access to your sanctions screening data is controlled through OAuth 2.0 providers — Google, GitHub, and Microsoft Entra ID — backed by JWT sessions with explicit expiry, role-based access controls, and a comprehensive audit trail.

OAuth 2.0 only

No passwords stored. Sign-in via Google, GitHub, or Microsoft Entra ID — provider-side MFA protects your account at the authentication layer.

Session expiry

JWT sessions with explicit maxAge configured for compliance-appropriate lifetimes. Sessions expire and require re-authentication — no indefinite tokens.

People and entities list showing screening status in Calmony dashboard

[ AUDIT / TRACEABILITY ]

Every action logged. Every decision traceable.

Calmony writes immutable audit log entries for every create, update, and delete operation on compliance-relevant data. Match reviews, GDPR deletions, API key issuance, data exports — each event is timestamped, attributed to a user, and retained.

STEP 01 — INGEST
Person added to screening list
A compliance officer adds an individual or entity. PII fields are encrypted with AES-256-GCM before the record is written to the database.
STEP 02 — SCREEN
Fuzzy matching against OFSI consolidated list
The record is immediately screened against the OFSI list — refreshed nightly — using fuzzy matching. Positive matches are flagged for human review.
STEP 03 — REVIEW
Compliance team reviews flagged match
Your team reviews the match with full context. Decisions — confirm, dismiss — are written to the audit trail with reviewer identity and timestamp.
STEP 04 — MONITOR
Nightly resync keeps every record current
Every monitored person is rescreened automatically each night when the OFSI list updates. New matches surface immediately without manual intervention.

0.1sPOST /api/people → encrypting PII fields

0.3sencryptField(fullName, dateOfBirth, nationality)

0.6srecord written — audit log: person.created

0.2sloading sanctioned entities from cache

0.5srunning fuzzy match across 3,000+ entries

0.9sstatus: MATCHED — pending review

0.1sGET /dashboard/matches → rendering match detail

0.4sreviewer: user@org.com → action: dismiss

0.7saudit log: match.reviewed — decision recorded

0.2scron: sanctions nightly sync → fetching OFSI CSV

0.5sbatch rescreen: all monitored people

0.8ssyncLog: version complete — status updated

[ GDPR / UK DATA PROTECTION ]

GDPR-aligned by design, not by checkbox

Rights your data subjects can exercise

Right to erasure via GDPR delete endpoint — anonymises PII across all tables
Data export available for subject access requests
Cookie consent management built in
Lawful basis documented at /lawful-basis

[ INFRASTRUCTURE / RUNTIME ]

Security controls at every layer of the stack

From HTTP headers to database queries, Calmony's architecture is designed with a defence-in-depth posture. Security hardening is implemented as code, reviewed in CI, and visible to your compliance team on request.

Content Security Policy headers configured on all responses
Rate limiting infrastructure across authentication and API routes
API key authentication for external integration endpoints
CORS policy on REST API v1 endpoints

[ DATA HANDLING / TRANSPARENCY ]

What we hold, why we hold it, and for how long

Neon Postgres

Your screening data lives in Neon's serverless Postgres with encrypted storage. No data leaves the EU data region for processing.

Published sub-processors

Every third-party service that handles data is named in our sub-processor register — with processing purpose and geographic location.

Adverse media monitoring dashboard in Calmony

[ PAYMENT / BILLING ]

Payment processing via Calmony Pay

Billing is handled through Calmony Pay — no card data touches our servers. Credit purchases are processed externally, with webhook events consumed and verified before any account credit is applied.

[ FREQUENTLY ASKED ]

Security questions, answered plainly

[ GET STARTED ]

Start screening with confidence

Questions about how Calmony handles your data? Email us at sf-core-org-support-calmony-sanctions-monitor@saas-factory.ai — we'll respond with specifics, not marketing copy.

Email our security team

AES-256-GCM encryption for every PII field