ISO/IEC 27001
Certified information security management, audited externally rather than self-declared.
Multi-factor authentication
Accounts are protected by a second factor, not a password alone.
Role-based access
People see the deals their organisation and role entitle them to, and nothing else.
Sealed bidding
No bank sees another bank’s pricing. Confidentiality is the product, not a setting.
Audit trail
Who did what, and when, across the life of every transaction.
KYC onboarding
Counterparties are onboarded and verified before they can transact.
Certification
An information security management system certified to ISO/IEC 27001 — the international standard for identifying information risks and controlling them.
What is certified
The management system: how risks are identified, who owns them, which controls apply, and how that is reviewed. It is audited by an external body rather than self-declared.
The four control themes
ISO/IEC 27001:2022 groups its Annex A controls into organizational, people, physical and technological. Our statement of applicability covers all four.
Getting the paperwork
Certificate number, registrar, scope and validity are available on request — ask your contact or write to support@tradeorigin.com.
Identity and access
Most breaches begin with an account, not a firewall. Access is layered accordingly.
Multi-factor authentication
Accounts are protected by MFA. A password alone does not get anyone in, and MFA enrolment is managed from the account itself.
Role-based separation
The platform separates what a corporate sees from what a bank sees, and separates roles within each organisation. You see the deals you are a party to.
Bot protection on authentication
Sign-in and registration are protected against automated abuse before credentials are ever checked.
Signature on the platform
Acceptance and signature are captured in the system, so approvals are attributable to a person and a moment. Email notifies people to act; it never carries the approval.
Sessions that cannot be lifted
The session context is held in a cookie the browser cannot read from script, restricted to same-site use, signed so it cannot be edited, tied to the token it was issued with so it cannot be replayed against another, and expired after eight hours. If any of those checks fails the request is treated as unauthenticated rather than given the benefit of the doubt.
Your documents and your data
A trade document is only useful to the people on the deal. That is how they are held.
Scoped to the transaction
Documents are uploaded against the transaction they belong to and released only to the counterparties on it. A bank that is not on a deal cannot see its paperwork.
Encrypted in transit, and pinned there
Everything between your browser and the platform travels over TLS, and the platform sends a strict transport security policy with a two-year lifetime, subdomains included and preloading requested — so a browser that has seen the site once will refuse to talk to it unencrypted afterwards.
Hardened in the browser
A content security policy restricts where scripts, styles and connections may come from and forbids the site being framed at all; responses also carry MIME-sniffing protection, a strict referrer policy, and a permissions policy that switches off camera, microphone, payment and USB access.
Separation between organisations
Access is decided per organisation and per role on every request, not hidden in the interface. A counterparty sees the deals it is a party to and the documents that deal exposes to it; being able to guess an identifier does not get anyone a record they are not entitled to.
Retention and export
Retention periods, export and deletion are covered in the contract, and the specifics are available on request. What we collect and why, who else sees it and what you can ask us to do about it is set out in the privacy policy.
Where it is hosted, and who else touches it
Hosting locations, data residency and the list of sub-processors that handle platform data — including the AI provider described below — are set out in the diligence pack, available on request under NDA. If your regulator constrains where data may sit, raise it before onboarding rather than after.
Backups and continuity
Backup, restoration and continuity arrangements are documented as part of the management system, and the summary is available on request.
Confidentiality on a live deal
The commercial confidentiality is the part clients ask about first, and it is a product decision rather than a setting.
Sealed bidding
The bidding process is completely confidential and secure. No bank sees another bank’s number, so pricing reflects the risk rather than the competition.
Limits stay private
A bank’s appetite and limits are visible to that bank and the counterparty it has agreed them with.
A record of every move
Bids, counter-bids, acceptances and amendments are recorded in sequence with a real-time audit trail, which is what makes reconciliation and audit straightforward afterwards.
Compliance
Onboarding and screening happen before and during the deal, not as an afterthought.
KYC at onboarding
Counterparties are onboarded with KYC before they transact. That is what lets the other side of a bid trust who they are pricing.
Sanctions assessment
Counterparties and countries are assessed for sanctions exposure as part of raising a deal.
Your own obligations
The platform supports your process; it does not replace your institution’s own compliance obligations or approvals.
Who at TradeOrigin can see your data
Access to production data is restricted to the people whose role requires it, under the same management system that is certified. The control description, and how access is reviewed and removed, are available on request.
Keeping the platform patched
Dependencies and platform components are monitored for known vulnerabilities and updated as part of ongoing maintenance. Where you need our remediation targets in writing for your own risk assessment, ask and we will provide them.
AI and third parties
AI does real work here — reading documents, assisting requests, screening — and it is wired so your documents are not handed to a third party by your browser.
Server-side, always
AI calls are made by the platform’s own server, authenticated as you. Your browser never talks to an AI provider directly, and no credentials for one are ever sent to it. To be plain about what that does and does not mean: an AI processor does receive the content it is asked to work on — it is the platform that sends it, under our contract with that processor, and it appears in the sub-processor list.
An explicit allow-list
Only a fixed list of AI operations can be invoked — document extraction, the forfaiting voice assistant, sanctions assessment and translation. Anything else is refused at the boundary.
What it is used for
Reading uploaded documents so a request fills itself in, taking a forfaiting request by voice, screening sanctions exposure, and translating across markets.
When something goes wrong
No security page is worth much if it only describes the good day. This is the part you should read hardest.
There is a plan, and it is tested
Incident response is part of the certified management system: how an incident is classified, who owns it, how it is contained and how it is reviewed afterwards. The plan is exercised rather than filed.
You will be told
If an incident affects your data, we will contact you with what we know, what we do not yet know and what we are doing about it — and we will keep updating you rather than going quiet until the investigation ends. Notification timeframes are set out in the contract, alongside the ones the law imposes on both of us.
Reaching us in a hurry
For a suspected security incident on your side that touches the platform — a compromised account, a document sent to the wrong counterparty — write to security@tradeorigin.com and say it is urgent, rather than raising a routine support ticket.
Afterwards
Incidents are reviewed for cause, not for blame, and the corrective actions feed back into the management system. Where an incident affected you, you can ask for the findings that concern you.
Found a vulnerability?
Tell us before you tell anyone else and we will work the issue with you. Write to security@tradeorigin.com with enough detail to reproduce it — a proof of concept, the affected endpoint, and what you were able to reach. We will acknowledge you, keep you posted while it is being fixed, and credit you publicly if you would like to be credited. Our machine-readable contact details are at /.well-known/security.txt.
Safe harbour. If you research in good faith and follow this page, we will not pursue legal action against you, and we will say so to anyone who asks. Good faith means: stop at the point of proving the issue, do not degrade the service for other users, and do not access, modify, retain or exfiltrate anyone else’s data. Use your own test accounts. If you reach real customer data by accident, stop, tell us, and delete it.
Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and talk to us if you think the timeline is running long. Social engineering of our staff, physical attacks and denial-of-service testing are out of scope.
Doing diligence on us?
Security questionnaires, the ISO certificate, the scope statement and contractual terms are handled by the team directly. Tell us what your process needs.