Trust centre
Trust centre
What a bank or lender's vendor review asks for, in one place. Public documents are linked below. The rest we share under NDA as part of your due diligence.
Section one
Public documents
Open to anyone, with no sign-up.
| Document | What it covers | Where |
|---|---|---|
| Security and compliance | Access control, encryption, the audit trail, AI governance, and the lending obligations the system is built to evidence | Security page |
| Website security grades | A+ on Mozilla Observatory and A+ on SSL Labs. The links run the test live | Observatory · SSL Labs |
| Hosting certifications | The certifications held by DigitalOcean, Neon and Amazon Web Services, which host the service in Singapore | Hosting |
| Sub-processors | Every provider that handles client data: what it sees, where it runs and when it applies | Sub-processors |
| Privacy policy | How we handle personal data under Hong Kong's Personal Data (Privacy) Ordinance | Privacy policy |
| Vulnerability disclosure | How to report a security issue, with our response times and safe-harbour terms | Policy · security.txt |
| Company facts | Registration details of Covenant Desk Limited | Company facts |
Section two
Shared under NDA
For lenders and banks assessing Covenant Desk as a supplier.
Security pack
Our information security and privacy policies, risk management, incident response, business continuity and supplier management.
Your questionnaire, answered
We complete your vendor due-diligence questionnaire and attach the evidence it asks for.
Regulator control mapping
Our controls mapped to the rules your supervisor applies, for example HKMA SA-2, TM-G-1 and OR-2, MAS Technology Risk Management and Outsourcing Guidelines, Taiwan FSC outsourcing rules and BNM RMiT, for your own assessment.
Data processing agreement
Processor terms under the Personal Data (Privacy) Ordinance: processing only on your instructions, security, breach notice, advance notice of new sub-processors and deletion at exit.
Independent testing
An independent CREST-accredited tester that you accept tests your deployment before any real customer data goes in.
Section three
Requesting documents
Email [email protected] with your organisation's name and what your review needs. We send our NDA first, or sign yours, then the documents. To report a security issue, follow the vulnerability disclosure policy.