Reference

Security and privacy overview

A high-level summary of how FlowSentry protects institutions' data, controls access, records activity and supports regulatory obligations.

FlowSentry teamUpdated 13 Oct 20265 min read

ForEveryone

On this page

FlowSentry handles some of the most sensitive data an institution holds: customer identities, transactions, suspicions and regulatory reports. This overview summarises, at a high level, the controls that protect that data and the evidence they produce. It is written for compliance, risk, audit and information-security teams evaluating or using FlowSentry.

Access control

Strong authentication

Multi-factor authentication with an authenticator app (TOTP) or passkeys (WebAuthn).
MFA is mandatory by default for the MLRO, Deputy MLRO and Administrator roles, and an institution can extend it to other roles.
Repeated failed sign-ins lock an account temporarily, and sign-in attempts are rate-limited.
Single sign-on with enterprise identity providers is available for enterprise deployments.

Step-up for sensitive actions

Actions with regulatory consequences, such as filing an STR, confirming a sanctions match, activating a rule or list, approving tenant settings or turning a kill switch, need a fresh second factor no more than five minutes old.

Role-based, default-deny permissions

Each person's access comes from their roles. Anything not granted is denied. Pages a role cannot open are not shown, and every action is checked again on the server when it is taken, so hiding a button is never the only control.

Segregation of duties

Maker-checker is enforced on the server for each item: the person who proposes, authors, records or captures something can never approve it. This covers STR decisions, alert QA, screening true matches, list and rule activation, onboarding, KYC changes, risk overrides and models, tenant settings and data source go-live.

Confidentiality

Tenant isolation

Every record belongs to one institution, and one institution can never see another's data. Isolation is enforced on every query, and an institution's internal watchlists are never used to screen another institution's customers.

Tipping-off controls

STR material is visible only to STR-privileged roles. Relationship managers and executives never see alerts or cases; a relationship manager answering an information request sees only the question. Exports of sensitive material are watermarked and recorded.

Masking and reveal

Identifiers such as national IDs, phone numbers and account numbers are masked in registers and exports. Revealing a masked value is recorded in the audit trail. Exports are formula-safe to prevent spreadsheet injection and are recorded against the person who made them.

Documents and evidence

Uploaded files are scanned before use and quarantined until clean.
Each document is encrypted at rest with its own AES-256 key, which is itself protected by a key unique to the institution.
Documents are viewed through short-lived links with a watermark naming the viewer.

Logging

Application logs contain no personal data.

Accountability

Tamper-evident audit trail

Every action is attributed to the real, named person who took it. The audit trail is append-only and hash-chained per module, so any alteration breaks the chain. Auditors and administrators can view it, and Chain integrity is re-verified every time the page opens.

Regulator-ready evidence

Rule versions, risk models, list versions, screening decisions, KYC changes and MLRO decisions all keep their history and the names of maker and checker. Regulator reviews supports examiner-style sample testing with findings and concurrence.

AI and data protection

Identifying values are pseudonymised before any model call and restored only on the user's screen. Some assistants never send certain values at all.
A self-hosted model tier keeps data within the institution's environment. Institutions holding real client data are pinned to it, or receive rules-based drafts.
Every model call is logged with the feature, model, cost, outcome and the person who asked.
Institution-wide and per-assistant kill switches can turn AI off at once.
AI drafts and explains; it never decides, files, approves or changes a regulated record.

See AI and data protection for more.

Data residency and retention

Data residency

FlowSentry can be deployed so that data and AI processing stay within the institution's chosen jurisdiction, using the self-hosted model tier with no data egress required.

Retention

Each institution has its own retention policy. The default is seven years, in line with POCAMLA record-keeping requirements. Purges produce signed deletion certificates as evidence.

Integrations

Every inbound request from a connected system is signed (HMAC-SHA256) with a timestamp and a single-use value, so tampered or replayed requests are rejected.
Each data source has its own signing key. Keys are shown once, stored encrypted and can be rotated or revoked with step-up.
Records carry the source system's reference, so resending never creates duplicates.
A data source goes live only after a second person approves it.
Outbound webhooks are signed so receivers can verify they came from FlowSentry.
Request sizes and batch sizes are limited, and error messages never echo submitted values.

Regulatory alignment

Framework	How FlowSentry supports it
POCAMLA and the AML Regulations 2013 (Kenya)	Monitoring, STR reporting and seven-year record keeping
Prevention of Terrorism Act 2012 and UN Security Council resolutions	Designated lists, targeted financial sanctions, domestic designations and nil/positive certificates
CBK Prudential Guidelines on AML/CFT and Digital Credit Providers Regulations 2022	Risk-based approach, CDD and EDD
FATF Recommendations	Risk-based approach, customer due diligence, record keeping, PEPs and suspicious transaction reporting
Data Protection Act 2019 (Kenya)	Minimisation, pseudonymisation, access control and retention
FRC goAML reporting	STR, SAR and CTR XML prepared and validated for portal upload

Important: FlowSentry supports compliance; your institution remains responsible for its AML/CFT programme, its policies and its decisions.

reference security privacy data protection compliance