Trust & Security
Granular access controls, independently audited controls, and organizational measures make Kooltra a safe and reliable partner for banks, brokerages, MSBs, and fintechs.
SOC 2
Type II
SOC 2 Type II report
Independently audited every year. Report available on request.
Request our security package →SOC 2 Type II
Audited annually
Encrypted in transit
TLS 1.2+ for all web sessions
24/7 monitoring
Continuous threat monitoring
Least privilege
Role-based access across all systems
Governance
Our security program is built on documented policies and continuous monitoring, validated through independent third-party audits and certifications. It is guided by four principles.
System access is limited to people with a legitimate business need, with role-based controls across all systems and applications.
Multiple layers of controls protect your data, from network perimeter defenses to application-level encryption and monitoring.
Controls are applied uniformly across the entire platform, so there are no gaps regardless of where your data resides.
We regularly assess and strengthen our posture through risk assessments, penetration testing, and control maturity evaluations.
Compliance & certifications
Kooltra completes an independent SOC 2 Type II audit every year. Our full report is available on request.
AML/KYC compliance workflows built in
Transaction monitoring capabilities
Regulatory reporting features
Financial data protection standards
Data protection
Isolated Salesforce organization for each customer
Production databases on our cloud infrastructure encrypted at rest
Encrypted file storage
TLS 1.2+ for all web sessions
Secure SFTP with SSH key authentication
Encrypted APIs for system integrations
Centrally managed TLS certificates
Web Application Firewall (WAF) protecting against attacks
Virtual Private Cloud (VPC) network isolation
Hardware Security Modules (HSMs) for key management
Comprehensive audit logging
Security operations
SIEM monitoring production infrastructure 24/7
Automated alerts for security anomalies
Logging of all cloud account activity
VPC traffic logs retained for at least one year
Automated scanning in the CI/CD pipeline
Container scanning on every deployment
Dependency vulnerability monitoring
Security patches tracked and prioritized
Peer review and approval for every code change
Automated security testing before production
Separate development, testing, and production environments
Integration testing includes vulnerability scanning
Deployment notifications to the engineering team
Documented incident response procedures
Bi-weekly security team meetings
Root cause analysis for all incidents
Annual tabletop exercises
Disaster recovery plan with tested procedures
Access controls
Multi-factor authentication enforced
Centralized user provisioning
Automated deprovisioning on termination
Annual access reviews
Administrative access restricted to authorized personnel
CI/CD system access limited to the engineering team
Production access requires MFA
Documented access request procedures
Management approval required for new access
Automated reconciliation of user accounts
Access removal tickets tracked for terminations
Vendor management
Data access levels
System integration depth
Business criticality
High-risk vendors are required to provide security documentation
Annual reviews of critical service providers
SOC 2 reports collected where available
Security questionnaires for vendors without audits
Employee security
Background checks for all positions
Signed employment agreements with confidentiality clauses
Code of Conduct acknowledgment required
Information security policy acceptance
Annual security awareness training
Endpoint protection on all devices
Mandatory disk encryption
Anti-malware software deployed
Performance reviews address security responsibilities
Business continuity
Load balancers distributing traffic
Auto-scaling groups for demand management
Multi-availability-zone deployments
24/7 service availability commitment
Daily database backups
Point-in-time recovery for production databases
Cross-availability-zone replication
Annual disaster recovery testing
Privacy & data handling
We maintain strict controls over data handling:
Customer data used only for agreed services
No third-party sharing except as required for service delivery
Data isolation between customers
Clear data retention and deletion procedures
Master subscription agreements define security commitments
Support for customer compliance requirements
Strong data protection controls
Regular compliance framework updates
Request our security package. We share our SOC 2 report and supporting documentation directly with your team.
.png)