Security and compliance,
built for regulated lenders
Credit Canary handles sensitive lending and open banking data for FCA-regulated lenders and credit unions. This is how we protect it — our certifications, our regulatory standing, and the controls behind the platform.
At a glance
The headline facts your risk, procurement and infosec teams need — each independently verifiable.
- Regulatory status
- Registered agent of OBConnect Limited, authorised and regulated by the FCA (Firm Reference Number 935017) for open banking account information services.
- Information security
- ISO 27001 certified information security management system (ISMS).
- Cyber security
- Cyber Essentials certified against the UK NCSC baseline.
- Data protection
- UK GDPR & Data Protection Act 2018. Registered with the ICO, registration number ZB437267.
- Hosting & residency
- Google Cloud Platform, London region (europe-west2). Customer data is processed and stored in the UK.
- Encryption
- TLS 1.2+ in transit and AES-256 at rest.
- Testing
- Independent third-party penetration testing, performed annually.
- Security contact
- infosec@creditcanary.co.uk
FCA-regulated open banking access
Credit Canary accesses customers' bank and credit data through open banking as a registered agent of OBConnect Limited, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 935017).
Explicit consent
We access account information only where the customer has given clear, informed consent — and we tell them exactly what will be accessed and why.
Read-only by design
We operate under account information services (AIS). Our access reads financial data to inform lending decisions — it never initiates payments or moves money.
Revocable any time
Customers stay in control. Consent can be withdrawn at any point, and access ends when it expires or is revoked.
You can verify OBConnect Limited (FRN 935017) on the FCA Financial Services Register.
Independently assessed, not self-declared
Our security posture is certified against recognised external standards and re-assessed on their required cycles.
ISO 27001
Our information security management system is certified to ISO/IEC 27001, the international standard for managing information security risk across people, processes and technology.
Cyber Essentials
We are certified under the UK National Cyber Security Centre's Cyber Essentials scheme, verifying the baseline technical controls that guard against the most common cyber threats.
Your data, handled lawfully and minimally
We process personal data in line with the UK GDPR and the Data Protection Act 2018. Credit Canary Limited is registered with the Information Commissioner's Office (ICO) under registration number ZB437267.
Read our Privacy PolicyData minimisation
We collect and retain only the data needed for the purpose it was gathered, and no longer than necessary.
Purpose and lawful basis
Every use of personal data is tied to a clear purpose and an appropriate lawful basis.
Data subject rights
We support access, rectification, erasure and other rights requests in line with UK GDPR timeframes.
Secure by architecture
The controls that protect the platform and the data flowing through it.
UK hosting & residency
Hosted on Google Cloud Platform in the London region (europe-west2). Customer data is processed and stored in the UK.
Encryption everywhere
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
Least-privilege access
Access is role-based and granted on a least-privilege basis, with multi-factor authentication enforced.
Logging & monitoring
Centralised logging and monitoring give us visibility of activity across the platform and support rapid response.
Encrypted backups
Backups are encrypted and retained to support recovery and continuity of service.
Annual penetration testing
Independent third parties test the platform every year, and we remediate findings on a risk-prioritised basis.
Security built into how we ship
Security isn't a stage at the end — it's part of our software development lifecycle from design through release.
Peer code review
Changes are reviewed by another engineer before they reach production.
Dependency scanning
Automated scanning flags vulnerable dependencies so they can be patched quickly.
Secure SDLC
Threat-aware design and controlled release processes keep risk out of the build.
Responsible disclosure
If you believe you've found a security vulnerability in Credit Canary, we want to hear from you. Please report it to our security team and give us a reasonable opportunity to investigate and resolve it before any public disclosure.
infosec@creditcanary.co.ukWhere we're heading
We continuously invest in our security and compliance programme. SOC 2 attestation is on our roadmap as we scale, building on the ISO 27001 foundation already in place.
Need our security pack for due diligence?
We're happy to support your risk, procurement and infosec teams. Talk to us for certificates, policies and detailed answers to your security questionnaire.