Security
Auditable because
you can read it.
The strongest security claim an infrastructure vendor can make is that you do not have to take their word for it. The entire pipeline is source-available under MIT, and you can run all of it inside your own perimeter.
Posture
Controls, and the
ability to verify them.
Compliance programs tell you a control was reviewed. Source access tells you what the control actually does. Moneyline is built to offer both.
Readable by design
Every parser, pipeline, and rule that touches your documents is published. Security review does not depend on a questionnaire.
Self-hostable in full
Run the API, worker, and database inside your own network with the included Docker Compose and Helm chart. Documents never cross your boundary.
Encrypted in transit and at rest
TLS on every connection, encryption at rest for stored documents and parsed output on the managed tier.
Scoped, revocable API keys
Keys carry explicit scopes and belong to an organization. A key issued for analysis cannot write, and any key can be revoked without rotating the rest.
Audit trail on every action
Document versions, rule changes, overrides, and deliveries are recorded with actor and timestamp for regulatory review.
Tenant isolation
Every query is scoped to an organization. Cross-organization sharing is explicit, recorded, and revocable.
Data handling
Where documents go,
and how long they stay.
- Self-hosted
- Documents stay on your infrastructure. We receive nothing, including telemetry: there is no phone-home in the open-source stack.
- Managed cloud
- Documents are processed in the region you select and stored encrypted. Retention is configurable per organization, and deletion through the API removes the stored file and its parsed output.
- Model training
- Customer documents are not used to train models. Parser improvements come from fixtures we own or have explicit rights to redistribute.
- Subprocessors
- The managed tier runs on a small set of infrastructure providers. The current list is available on request and to customers under contract.
Reporting a vulnerability
Send findings to the security address below. Please include reproduction steps and give us a reasonable window to ship a fix before disclosing publicly. We will confirm receipt, keep you updated, and credit you in the release notes unless you prefer otherwise.
security@moneyline.coDo not include customer data or live credentials in a report.
Reviewing us for
a security questionnaire?
Most answers are in the source. For the ones that need a signature, or for a subprocessor list under contract, get in touch.