Built for the people who can say no.
Compliance officers do not sign. They veto. This page names each control and the mechanism behind it, states plainly what it does not cover, and ends in something a reviewer checks independently rather than accepts on trust.
The controls, and the mechanisms behind them.
One row per control. Each opens to the mechanism behind it.
TENANT ISOLATION Enforced at the database
Postgres row-level security on every tenant-scoped table. Separation is enforced in the database, not in the application layer, and the isolation tests include the cases that must be refused, executed and recorded rather than asserted.
AUTHENTICATION No codes by SMS or email
AAL2 on every protected route. An authenticator app is the second factor today; device-bound passkeys are shipped for signing on mobile. No SMS and no email one-time codes, channels regulators in a growing set of jurisdictions are phasing out. Device-bound passkeys, where used, are additionally phishing-resistant.
GOVERNED AI Surfaces, never decides
The models flag inconsistencies and adverse findings, with the reason a signal fired recorded beside it. A human makes every approval, with each model inventoried, documented and explainable, as the strictest AI-governance regimes require.
DATA PROTECTION One design, every regime we serve
Engineered to support obligations under GDPR, Switzerland's revised FADP, and the regional data-protection frameworks our clients operate under, including correction rights for individuals named in screening. Document access is served over signed, logged URLs. TLS 1.2 or higher in transit.
EVIDENCE Checked with free standard tools
Ed25519 signatures over a SHA-256 hash chain, timestamped by an independent RFC3161 authority. Checked offline with standard tools: SHA-256, Ed25519 and RFC 3161 are published formats, so a reviewer works from the pack itself. Fail-closed by design: when timestamping is required, no valid timestamp means no evidence pack.
AUDIT TRAIL Tamper-evident, not tamper-proof
Every state-changing action is hash-chained, so a change, an insertion or a reordering is detectable. A hash chain detects; it does not prevent, and we will not say it does. Document access logs are retained for seven years.
DISCLOSURE ACKNOWLEDGEMENTS Pinned to the exact wording
When an investor accepts a required risk acknowledgement, the record keeps more than a checkbox. The acknowledgement text is versioned, and the SHA-256 digest of the exact wording accepted is written into the hash-chained record, so a quiet rewrite of what someone agreed to would stop the digests matching. Changed wording becomes a new version, never an edit to the old one.
SCOPE OF THE RECORD What is not in the record
Documents, signatures and document access are part of the cryptographic record. Messaging between parties is ordinary application data: not hashed, not chained, not timestamped. We do not present it as evidence.
CERTIFICATION STATUS Stated exactly
A SOC 2 Type 2 and ISO 27001 readiness programme is in progress. No report is held today, and nothing here should be read as implying one. When a report exists, this line will say so and name its date.
Part of the cryptographic record: documents, signatures, and document access. Not part of it: messaging between parties, which is ordinary application data: not hashed, not chained, not timestamped, and which we do not present as evidence.
The published instruments behind those controls.
Each entry names an instrument and the body that issued it. Naming one means the platform was engineered to its published requirements, on the terms set out above, and the line under each says what that gets the reader rather than what it gets us.
- EU / CH GDPR and the Swiss revised FADP Tenant isolation enforced in the database itself, with defined retention and a documented route for correcting a record. Regulation (EU) 2016/679; Federal Act on Data Protection, SR 235.1
- EU eIDAS advanced-signature criteria (Art. 26) A signature uniquely linked to its signatory and to the document, so a later change to either is detectable. Advanced, not qualified. Regulation (EU) No 910/2014, Art. 26
- IETF RFC 3161 timestamping The time on the record comes from an independent authority, not from us. Admissible evidence of when a document existed. Time-Stamp Protocol (TSP), RFC 3161
- IRTF / NIST Ed25519 and SHA-256 Published algorithms, so an evidence pack can be checked with ordinary tooling by someone who does not trust us. Edwards-Curve Digital Signature Algorithm (EdDSA), RFC 8032; Secure Hash Standard (SHS), FIPS 180-4
- W3C WCAG 2.1 AA Audited against with axe, page by page, which is what a public-sector or institutional procurement review asks for. Web Content Accessibility Guidelines 2.1, Level AA
The vocabulary, in one sentence each.
The rest of the site says what these do in plain words. This is the one place that names them, so a technical reviewer and our documentation are using the same terms.
- Evidence pack
- The record a raise closes in: every document, identity check and signature, in order, packaged so a third party can check it offline.
- SHA-256 hash chain
- Each entry carries a fingerprint of the one before it. Change, insert or reorder anything and the chain stops matching. It detects tampering; it does not prevent it.
- RFC 3161 timestamp
- A signed time assertion from an independent authority (a clock that is not ours), attesting the record existed no later than that moment, on that service's authority.
- Ed25519 signature
- The cryptographic signature scheme signing each record: who produced it, and that not one byte has changed since.
- AAL2
- An authentication assurance level (NIST SP 800-63B): signing in needs a second factor as well as a password. Today that factor is an authenticator app; device-bound passkeys are used for signing on mobile. It raises the bar, but it is an assurance level, not a guarantee against phishing.
- Fail-closed
- When a proof ingredient is unavailable (the independent clock, say) the system stops rather than producing a record it cannot prove.
Proof a reviewer checks independently.
An evidence pack is not a screenshot of trust. It is a signed, timestamped, hash-chained record checked with free standard tools, on the reviewer's own machine: the check confirms the documents are unchanged and existed at the stated moment, because the timestamp comes from an independent authority. Because the formats are published, the person on the other side of a disagreement can run exactly the same commands and get exactly the same answer.
The tooling has a name: exedragate-verify, a standalone command-line verifier described on the technology page. Standard OpenSSL checks the timestamp on its own, so no reviewer is ever limited to our tooling.
Security questionnaires are answered directly.
We answer compliance and security diligence ourselves, and we would rather be asked early than late. A name and a company suffice; the request reaches the right person.
Compliance teams: compliance@exedragate.com · Security: security@exedragate.com