Security & Data Handling
A summary for bank and credit union vendor-management teams.
At a glance
- U.S. only: the website, database and document storage are hosted in the United States.
- Encrypted: TLS 1.2+ in transit; AES-256 at rest.
- Verified senders: uploads are only accepted after you confirm your work email with a one-time code.
- Private by default: documents are never public, never emailed as attachments, and are reachable only by named Paladin staff and Paladin's own intake workflow, through short-lived, single-purpose links.
- Audited: every staff download is logged with who, what and when.
- Scanned: every file is checked for its real file type and scanned for malware before staff can open it.
- No AI training: your documents are never used to train AI models. See our AI Safety Policy.
- Retention: documents are deleted automatically 180 days after submission, or once your report has been delivered, whichever comes first, or sooner on request.
Service providers (sub-processors)
| Purpose | Provider & location |
|---|---|
| Website & application hosting | Vercel (functions pinned to US-East, Washington D.C.) |
| Document storage | Amazon Web Services S3, US East (Ohio) region, encrypted at rest |
| Malware scanning | Amazon GuardDuty Malware Protection for S3 |
| Database (contact details, audit log) | PostgreSQL, US-East region |
| Transactional email | Resend (United States) |
| Bot protection | Cloudflare Turnstile |
| Website visitor analytics (public pages only) | Apollo.io, with identity partner LiveIntent (United States) |
| Staff sign-in | Google Workspace (Paladin accounts with multi-factor authentication) |
| Contract analysis (Paladin internal) | Paladin's analysis workflow (n8n), used by Paladin analysts after intake |
Questions or due-diligence requests
Contact our Data Integrity Team at bto@paladin-fs.com or 877-746-4859. To report a security issue, see security.txt.