SOC 2 CC6.1
Least privilege by default
A new user can read nothing. Access is granted per ledger and expires unless it is renewed.
Contact
See it against your own data
Thirty minutes, your ledger, our engineer. We will show you the breaks you have right now, or tell you that you have none.
Contact
See it against your own data
Thirty minutes with an engineer and a sample of your ledger. We will show you the breaks you have today, or tell you that you have none — which does happen, and we will say so.
Sales
sales@cirrus.finance
Security
security@cirrus.finance
Trust centre
trust.cirrus.finance
Offices
London · New York · Singapore
Security
Controls your auditor can test
Every control below maps to a clause and produces exportable evidence, because an assertion in a PDF is not a control.
SOC 2 CC7.2
Every read is logged
Not just writes. Who looked at which ledger, when, and from where, retained for seven years.
ISO 27001 A.10
Encrypted with your keys
Bring your own KMS key. Revoke it and the data is unreadable, including to us, within the hour.
GDPR Art. 44
Data residency
EU, UK, US or Australia. Data does not leave the region you pick, including backups and logs.
SOC 2 Type II
Evidence, not assertions
Control evidence is exportable on demand, so your auditor tests the system rather than reading our description of it.
SOX 404
Segregation of duties
The person who creates an adjustment cannot approve it. Enforced in the data model, not in a policy document.