Trust and security at Salv
What we hold, where your data sits, and how every decision is recorded.
Trusted by 130+ financial institutions across 30 jurisdictions
More than 130 institutions across 30 jurisdictions rely on Salv. Salv holds a SOC 2 Type 2 report covering the Security category and is certified to ISO/IEC 27001:2022. Personal data processed for a client is stored in AWS data centres in Frankfurt, Germany, and Salv contracts under DORA as an ICT third-party service provider supporting critical or important functions.
What Salv is certified to: SOC 2 Type 2 and ISO/IEC 27001:2022
Salv's SOC 2 Type 2 report is issued by Thoropass Assurance, and its ISO/IEC 27001:2022 certification by KPMG IT Certification Ltd. Both are renewed annually and shared during the RFP process.
Salv Technologies OÜ is certified to ISO/IEC 27001:2022 under certificate number FI231113-131, issued by KPMG IT Certification Ltd. The certified scope reads, verbatim: "Development and maintenance of Salv SaaS platform for financial crime fighting, including: sanctions, PEP and adverse media screening, transaction monitoring and customer risk assessment, collaborative case management system across financial institutions in Tallinn, Estonia."
Neither document is downloadable. Both travel through our RFP route.
Where your data sits: data residency in Frankfurt
Salv runs on AWS, with personal data processed on a client's behalf stored across all three availability zones in Frankfurt. Private cloud and on-premise deployments are also available.
DORA and your supervisor
DORA places its obligations on the financial entity and the contracts it holds with its ICT providers. Under Salv's contracts, clients, their appointed auditors and competent authorities hold rights of access, inspection and audit.
See it on your own data
How your data is protected, from pen testing to breach notice
Customer data is encrypted in transit over public networks. An external party penetration-tests production annually, and internal vulnerability scans run continuously. Salv notifies clients within 48 hours of becoming aware of a personal data breach, and the Data Protection Officer is reachable at [email protected].
You own your data, can export it through the REST API at any time, and receive it in a commonly used machine-readable format on exit, with no unreasonable fees. On termination, Salv returns or deletes personal data on written request, and otherwise deletes it within one month of the end of the services.
Every decision on the record: the AML audit trail your supervisor asks about
Every change is timestamped with what changed, when and by whom, and access is role-based. An alert's status can't change without a note, notes can't be deleted, and an alert closed by a clearance rule stays on the record with the rule shown against it. Even a permanent deletion of a person or transaction is logged. Scenario versions can't be edited after the fact, and configuration changes can require a second person's approval.
Export alerts by filter to CSV with an Audit template built for regulatory and internal audit, along with dashboards, entities and histories.
FAQ
Salv holds a SOC 2 Type 2 report covering the Security trust services category, issued annually by Thoropass Assurance. It is restricted-use, so it is shared through our RFP route rather than published.
In AWS data centres in Frankfurt, Germany, across all three availability zones. Private cloud and on-premise are also available.
DORA has no certification or attestation scheme, so no vendor holds a DORA certificate. Salv contracts as an ICT third-party service provider supporting critical or important functions, and clients, their auditors and competent authorities hold rights of access, inspection and audit.
Yes. Changes are timestamped with what changed, when and by whom, an alert's status can't change without a note, and notes can't be deleted. Alerts, dashboards, entities and histories all export.