Legal
Security at Credyx
Last updated: July 2026
Credyx exists to make credit decisions defensible, which means the platform itself has to be defensible. This page describes the concrete measures we take today — no more, no less.
Encryption in transit
All traffic — browser, API, and registry fetches — runs over TLS. Public endpoints sit behind Cloudflare, which terminates TLS and absorbs volumetric attacks before they reach origin.
Data provenance
Company data comes directly from official government registries and free public aggregators. Every figure traces to a source document URL; nothing is fabricated, interpolated, or bought from data brokers.
Audit-ready by design
Risk assessments are persisted permanently with the exact ratios, signals, and model version that produced them, so any past credit decision can be reconstructed and defended.
Role-based access
Administrative functions are gated behind a separate admin role. Regular accounts can never reach user management, plan configuration, or audit logs.
Rate limiting and quotas
Per-account rate limits and plan quotas are enforced server-side on every endpoint — including internal traffic. There is no bypass tier.
Sanctions-aware pipeline
OpenSanctions screening runs alongside registry lookups, so sanctioned or PEP-linked counterparties are flagged rather than silently scored.
Infrastructure
The platform runs on managed cloud infrastructure: PostgreSQL for persistent data with encryption at rest, Redis for rate limiting and queues, and isolated worker processes for registry scraping so third-party fetches never run in the request path with user credentials. Database access from outside the private network is closed. Secrets are injected via environment configuration, never committed to source control.
Authentication and payments
Passwords are stored only as salted hashes. Sessions use short-lived bearer tokens that are revocable server-side; changing your password invalidates all existing tokens. Card data never touches our servers — payment processing is delegated entirely to our payment provider.
What we deliberately don’t do
- No mock or fallback data. If a registry cannot answer, the API says so with an explicit error — a fabricated number in a credit decision is a security problem, not a UX problem.
- No arithmetic in the language model. Financial ratios are computed deterministically in code before any model sees them.
- No paid data brokers. Sources are official registries and free public aggregators, so there is no shadow copy of your counterparties’ data circulating through resellers on our account.
Certifications
Credyx does not currently hold SOC 2 or ISO/IEC 27001 certification, and we won’t imply otherwise. Our practices are informed by those frameworks, and we will update this page as our compliance program matures. Enterprise customers can request our current security questionnaire responses via [email protected].
Responsible disclosure
If you believe you have found a vulnerability, email [email protected] with reproduction steps. We commit to acknowledging reports within two business days and will not pursue action against good-faith research that avoids privacy violations and service disruption.
For how we handle personal data, see the privacy policy and data processing agreement.