Trust & Compliance
Credit Canary handles regulated credit, identity and payments data for UK lenders. Our certifications, regulatory standing, availability commitments and data practices, in one place for your procurement and risk teams.
Certifications & standards
Our security posture is certified against recognised external standards and re-assessed on their required cycles, not self-declared.
Our information security management system is certified to the international standard for managing information security risk.
Certified under the UK National Cyber Security Centre scheme for the baseline controls that guard against common threats.
Compliant with UK GDPR and the Data Protection Act 2018, and registered with the Information Commissioner's Office.
SOC 2 attestation is on our roadmap as we scale, building on the ISO 27001 foundation already in place.
FCA-regulated open banking access
Credit Canary is a registered agent of OBConnect Limited, authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 935017) for open banking account information services.
We access account information only where the customer has given clear, informed consent. Access is read-only, limited to what the customer agrees to, and can be revoked at any time.
Availability & performance
We commit to keeping the service operational and able to connect to associated ASPSPs via the TPP Framework with successful responses.
Response time is the duration between sending a message to an ASPSP and receiving its response, and depends in part on ASPSP performance, which we cannot control. Where applicable we monitor performance and escalate issues to Open Banking and individual ASPSPs as needed.
How your data is handled
Data is hosted and processed in the UK on Google Cloud.
Data is encrypted in transit and at rest.
Access is granted on a need-to-know basis and reviewed.
Activity is logged and monitored for anomalies.
Backups are encrypted and regularly tested.
Independent penetration tests are run each year.
We bring in credit and identity data from established providers, including TransUnion, under appropriate agreements and controls.
Doing due diligence?
We will share our security pack, certifications and data processing details with your procurement and risk teams. For the full technical picture, see our security page.