The hosted service runs in Singapore. A deployment in your own cloud or data centre is also possible, and hosting is arranged with your IT and security teams.
Asia · Deployment and assurance
Deployment, data residency and AI governance, answered before your vendor review asks
Hosted in Singapore or run in your own cloud or data centre, on a dedicated instance, with the AI model your bank approves and every AI call logged.
In brief
What a bank's technology risk team asks first
A bank does not buy lending software before its technology risk, information security and outsourcing teams have signed off. They ask where the data sits, who can reach it, what the AI sees, how an incident is traced and how the bank gets out. This page answers those questions in the order they are usually asked.
The detail sits on the security and compliance page and in the security pack, which is shared under NDA. Covenant Desk is software: the obligations stay with your institution, and what we publish is which of them our controls and records are built to evidence.
Asia
Deployment options and data residency
- 01
Hosted in Singapore
Our hosted service runs in a Singapore data centre, with the database on managed PostgreSQL on Amazon Web Services in Singapore. Provider certifications belong to the providers.
- 02
In your own cloud or data centre
A deployment in your own environment carries your provider's certifications and your own network controls.
- 03
Dedicated, not shared
Your instance, database and backups are yours alone. Nothing is shared with another customer.
- 04
Data stays in the agreed region
The database, uploaded documents and backups stay in the region agreed for your deployment. The only outside call is to the AI model your bank approves.
- 05
Single sign-on
Sign-in with your directory is set up in your deployment.
- 06
A rollout your IT team signs off
Integration specification, test plan, data migration and cut-over are agreed with your IT and security teams, one workflow at a time.
Covenant Desk
What your security and technology risk team receives
All of this is available, built to your operation and delivered as part of the implementation.
- 01
Access
Two-step sign-in, roles, approval limits and a second-person check. Staff see only the companies and modules their role allows, and phone numbers are masked.
- 02
Encryption
TLS on every connection, each uploaded document encrypted on its own with AES-256-GCM, and the database and backups encrypted at rest.
- 03
Audit trail
Every action goes into an append-only, hash-chained log that shows if anything was changed afterwards. Retention follows your policy.
- 04
AI governance
Identifiers are masked before any AI call and every call is logged. You choose the model or switch AI off. AI prepares the decision; rules grade the case and a named credit officer approves it.
- 05
Independent testing
An independent CREST-accredited tester that you accept tests your deployment before any real customer data goes in.
- 06
Exit
At the end of the contract you receive a full export of your data. We then delete it and confirm the deletion in writing.
- 07
Security pack
Our controls mapped to the rules your supervisor applies, security questionnaire answers, the data processing terms and the sub-processor list, shared under NDA for your own assessment.
Evaluation
Vendor due-diligence questions for any lending platform
- 01
Where is the data, and who can reach it?
Region, tenancy, staff access to production and how that access is recorded.
- 02
What does the AI see?
Which fields are masked before a model call, which model is used and whether it can be switched off.
- 03
How is AI output controlled?
Who approves, what is logged and whether a person must confirm any change to a record.
- 04
How is data protected?
Encryption in transit, per document and at rest, and who holds the keys.
- 05
Who tests it independently?
Scope, tester, timing and whether findings are shared.
- 06
How does exit work?
Export format, deletion and written confirmation.
FAQ
Questions banks and lenders ask
The only outside call is to the AI model your bank approves. Identifiers are masked before any AI call, and every call is logged. AI can be switched off.
No. AI prepares the decision, rules grade the case and a named credit officer approves it.
The hosted platform runs on ISO/IEC 27001-certified data centres and on cloud and database providers with SOC 2 Type II reports, and a deployment in your own cloud runs under your certifications. We share our security pack, answers in the CSA CAIQ format, the data processing terms and the sub-processor list for your own assessment.
You receive a full export of your data. We then delete it and confirm the deletion in writing.
We prepare a mapping of our controls to the rules your supervisor applies, for example HKMA SA-2, TM-G-1 and OR-2, the MAS Technology Risk Management and Outsourcing Guidelines and BNM RMiT, for your own assessment.
Related
More for banks and lenders in Asia
- Loan origination system for banks and lenders in Asia
- Loan management system for banks and lenders in Asia
- The AI lending system for banks across Asia
- Custom lending software, built around your process and integrated with your systems
- An AI lending system that runs beside the core banking system you already have
- AI lending agents for banks, by role, with credit officers approving every decision
- AI lending system across Asia
- Loan origination system, Hong Kong
- Loan management system, Hong Kong
See it on one of your own loans.
We set up a personalised demo around your own products and workflows, then your team tries it before you decide.
Book a personalised demo