Written for your risk team and your diligence team

Borrower data is collected under explicit, per-account consent and used only for the credit decision it was provided for. No client's data trains models for another client. Statement files are encrypted at upload and retained per your retention policy, then deleted on schedule.

TLS 1.2+ in transit, AES-256 at rest. Keys are managed in a cloud KMS with rotation; application secrets never live in code. Documents and PII are encrypted with separate key scopes from operational data.

Deployments run in-region. Pakistani client data stays in Pakistan-approved infrastructure; GCC deployments use in-country or in-region cloud per the local regulator's requirements. Dedicated single-tenant environments are available at the Network tier.

Every credit decision carries an immutable trail: inputs, rule evaluations, score versions, and the operator who actioned it. Vertex's ledger is append-only; balances reconstruct from transfer history. Audit exports map to your chart of accounts and your regulator's reporting formats. SOC 2 Type II certification is in process.

Role-based access throughout, maker-checker on every money movement, and named-user attribution on every action. Client admin teams manage their own roles; Trazmo staff access to production data is logged, scoped, and reviewable by the client.

The rail supports Sharia-compliant product structures natively. Products are configured with profit rates or markup; Murabaha and similar facility structures carry their commodity and ownership steps in the ledger, so the accounting reflects the structure rather than approximating it. Scholar board review of specific configurations remains the institution's process; we provide the documentation pack for it.