Trust & Security

How we protect your data, and where we stand on compliance

This page sets out how Black Keys protects the records that institutions keep on the platform: what is in place today, and what is still in progress.

Security Architecture

Encryption at Rest and in Transit
Stored data is encrypted at rest and every connection is encrypted in transit. Sensitive notes kept on a household are encrypted a second time inside the database with pgcrypto, so the database holds them only as unreadable ciphertext.
Role-Based Access Control
Fine-grained permissions enforced at the database level through Row Level Security policies, ensuring users only access data they are authorized to see.
Multi-Tenant Data Isolation
Institutional data is fully isolated at the database level. Cross-tenant access is prevented by design through enforced foreign key constraints and RLS policies.
Append-Only Audit Logging
Data access and modification are recorded in an append-only audit log. Row-level security policies prevent audit records from being altered or removed through the application; no operator or administrator account can rewrite them.
Multi-Factor Authentication
Multiple authentication methods are supported: passwordless magic-link sign-in, email and password with multi-factor authentication, one-time codes, and Google OAuth.
Managed Cloud Infrastructure
The application runs on Vercel and the database on Supabase, with automatic scaling and the DDoS protection those providers supply.

SOC 2 Type II
On the roadmap
SOC 2 Type II is on our roadmap. Our security documentation is available on request.
GDPR
In Progress
We are working toward full compliance with the General Data Protection Regulation. Application data is held in the European Union with per-institution isolation and append-only audit logging. Retention, deletion, legal-hold, and consent mechanisms are built into the platform, and Data Subject Access Requests are handled as a supervised manual process within the statutory 30-day window. Automated data export, portability, and self-service privacy controls are still being rolled out.
Swiss Data Protection Act (nDSG)
In progress
The revised Swiss Federal Act on Data Protection (nDSG/FADP) has applied since September 2023. The controls described on this page serve it as they serve the GDPR. No external assessment against the nDSG has been carried out yet.
FINMA outsourcing requirements
Not assessed
The platform has not been assessed against FINMA's requirements for outsourcing and operational risk. An institution supervised by FINMA carries out its own assessment, and we answer its questions on our architecture and data handling.

Data Retention Policies
Our retention policy keeps active member data for the duration of membership plus 5 years, and financial records for 10 years to meet regulatory requirements. Retention is governed and applied as policy today; the platform's automated per-category lifecycle enforcement is being rolled out.
Data Subject Access Requests
Members and institution contacts can request a copy of their personal data. Each request is answered within the GDPR-mandated 30-day window and is tracked against that deadline. Collection and delivery are performed manually today; the automated collection, packaging, and self-service delivery pipeline is still in development.
Right to Deletion
Deletion requests are honoured by anonymising the member's personal identifiers, including name, contact details, date of birth, and nationality, after a 30-day grace period. Legal holds can freeze a record from deletion, and each action is written to a deletion audit log. Cascading erasure across all related records, and the purging of data exports generated before deletion, are still in development.
Consent Management
Consent is recorded per individual in an append-only register that captures the actor, source, and version of each decision, so the history cannot be rewritten. Consent can be withdrawn at any time by contacting us; self-service withdrawal from the member application is still in development.