Application servers
DigitalOcean, Singapore data centre. DigitalOcean holds SOC 2 Type II and SOC 3 reports and CSA STAR Level 1, and lists its colocated data centres, Singapore among them, as ISO/IEC 27001 certified.
Security and compliance
Your obligations. Our evidence.
Covenant Desk is software. The obligations on this page remain your institution's. What we publish is which of them our records, controls and exports are built to evidence.
How it is protected
Separate storage, and a locked front door.
Every client gets their own database cluster. Your borrower records are not rows in a shared table alongside another lender's. They live in storage provisioned for you, which is what keeps one client's data private from every other client rather than relying on a filter in the application to hold the line.
Getting in takes more than a password. Two-factor authentication protects staff accounts, reCAPTCHA screens automated sign-in and form attempts, and an account is limited to one active session at a time, so a shared or stolen credential cannot quietly be used in two places at once.
Inside, access is scoped and recorded. Staff see only the companies and modules their role allows, exact-HKID lookups across companies are permission-scoped, phone numbers are masked, and sensitive lookups, edits and admin changes are written to an audit log against a named user and timestamp.
Vendor due diligence
What a bank's vendor review asks, answered before it asks.
- 01
Dedicated instance
Your instance, database and backups are yours alone. Nothing is shared with another customer.
- 02
Data residency
Database, uploaded documents and backups stay in the agreed region. The only outside call is to the AI model your bank approves.
- 03
AI governance
Identifiers are masked before any AI call and every call is logged. AI prepares the decision; rules grade the case and a named credit officer approves it.
- 04
Access
Two-step sign-in, roles, approval limits and a second-person check; single sign-on with your directory is set up in your deployment.
- 05
Encryption
TLS on every connection; each uploaded document encrypted on its own with AES-256-GCM; database and backups encrypted at rest.
- 06
Audit
Every action goes into an append-only, hash-chained log that shows if anything was changed afterwards. Retention follows your policy.
- 07
Independent testing
An independent CREST-accredited tester that you accept tests your deployment before any real customer data goes in.
- 08
Exit
At the end of the contract you receive a full export of your data; we then delete it and confirm the deletion in writing.
We prepare the mapping of our controls to the rules your supervisor applies, for example HKMA SA-2, TM-G-1 and OR-2, MAS Technology Risk Management and Outsourcing Guidelines, Taiwan FSC outsourcing rules and BNM RMiT, for your own assessment. Our security pack is shared under NDA.
Hosting
Run on independently certified infrastructure.
Our hosted service runs in Singapore on independently certified infrastructure: ISO/IEC 27001-certified data centres and cloud and database providers with SOC 2 Type II reports. A deployment in your own cloud or data centre runs under your provider's certifications.
Database
Neon managed PostgreSQL, which holds ISO/IEC 27001 and ISO/IEC 27701 certification and SOC 2 Type 2 and SOC 3 reports.
Underlying cloud
The database runs on Amazon Web Services in Singapore. AWS holds ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certification.
The framework
Nine obligations, and what the software does about each.
Each item names the instrument and the body behind it. Banks map the same controls to HKMA requirements; where a duty is your institution's alone, it says so.
Licences are granted by the Licensing Court, subject to the conditions it imposes. The Registrar of Money Lenders — a role held by the Registrar of Companies through the Companies Registry — processes applications and renewals, maintains the public register and monitors compliance. The Commissioner of Police examines applications and investigates complaints. In the product: application, approval, agreement and repayment records are structured so the whole file behind any one loan can be produced intact.
Since 30 December 2022 the effective interest rate cap under Cap. 163 has been 48% per annum, with 36% per annum as the extortionate threshold above which a court may reopen a transaction under section 25. In the product: the effective rate is computed on every product configuration and flagged against the thresholds you set. The thresholds are configured by you and applied by your staff.
Additional and revised licensing conditions imposed on grant or renewal cover a debt servicing ratio cap and repayment-period limit for low-income earners on unsecured personal loans, a risk-warning statement in advertising, and — where a referee is provided — a written consent signed by that referee, attached to the loan agreement. In the product: income evidence, the DSR calculation and the repayment term sit on the application record, and a referee's signed consent is captured and attached to the loan. The caps themselves are promulgated by the Registrar; we implement the figures you are subject to, we do not set them.
Banks are financial institutions under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). Licensed money lenders are not, and the duty reaches them through licensing conditions that require compliance with the Registrar's AML/CFT guideline. In the product: PEP, sanctions and adverse-media screening for individuals and companies, ongoing monitoring with PEP updates within 24 hours, and transaction monitoring with around 50 preset rules. Possible matches and named-user clear or confirm decisions stay on the customer record; your authorised staff remain responsible for due diligence and determinations.
Separately from Cap. 615, the Drug Trafficking (Recovery of Proceeds) Ordinance, the Organized and Serious Crimes Ordinance and the United Nations (Anti-Terrorism Measures) Ordinance each impose a direct duty on any person — money lenders included — to report suspicion to the Joint Financial Intelligence Unit. In the product: an internal escalation trail from the flagging staff member to your Money Laundering Reporting Officer, with the tipping-off restriction reflected in what the borrower-facing app shows. Covenant Desk does not file reports and does not transmit to the JFIU.
The Registrar's AML/CFT guideline requires due diligence records, transaction records, correspondence and analysis to be kept throughout the business relationship and for at least five years after it ends, with an audit trail that is clear, complete and retrievable quickly. In the product: sensitive lookups, profile edits, sync actions and admin changes are logged against a named user and timestamp, and the underlying records export on demand. Retention periods are configured by you; nothing is deleted on our schedule.
The Personal Data (Privacy) Ordinance applies to you as data user. Borrower data in Covenant Desk is yours. In the product: implementation maps your consent points, collection statements, staff access scope, retention expectations and data access request handling before rollout. Software can help you meet PDPO obligations; no product is “PDPO certified”, and no such certification exists.
FPS is payment infrastructure introduced by the Hong Kong Monetary Authority and operated by Hong Kong Interbank Clearing Limited. Its participants are licensed banks and licensed stored value facility operators only, so neither a money lender nor a software vendor can be an FPS participant, and there is no FPS certification for software. In the product: FPS-standard QR codes are generated, FPS proxies are recorded against loan accounts, and credits are reconciled — through your own bank or payment service provider.
CDS is the multiple credit reference agency framework launched in 2024. Participation by money lenders is voluntary today. The Government has proposed two further licensing conditions, both proposed to take effect on 1 June 2027 with a transitional period. In the product: CDS data-readiness. A human-readable XLSX readiness preview covers recent application, approved-term and repayment records and flags source-data issues, so your records are ready for the official specification. Your institution submits to CDS; Covenant Desk does not operate CDS or submit on your behalf.
Controls
What your team can review before production setup.
Role-based access
Admin, manager, staff and viewer roles combine with module, feature and action-level permissions.
Company scoping
Staff can be scoped to one company or a controlled set of company units, while admins keep the group-level view.
Audit logs
Sensitive lookups, assistant queries, profile edits, sync actions and admin changes are recorded for traceability.
HKID and phone handling
Exact-HKID search is permission-scoped and audit-logged. Phone numbers are masked where the user context requires it.
Borrower consent
Intake and loan request flows preserve the borrower's consent, so a lender receives only the requests the borrower chose to share.
AI controls
Every AI action is logged, permissioned and reviewable. The AI prepares the work and your credit officers approve it; edits require proposal, confirmation, application and audit logging.
Review the controls against your own supervisory requirements.
Bring your regulatory requirements, your AML procedures and the records your auditor asks for. We will show you where each one lands in the system rather than walking through a feature list.
Book a personalised demo