Role and tenant boundaries
Administrative responsibilities are separated and company-scoped management paths use permission and tenant checks. Support access is intentionally narrower and does not provide employee impersonation.
Enterprise trust center
CardIQ Trust & Security Center
A procurement-oriented view of what CardIQ currently implements, what depends on deployment or contract, and what is not yet claimed or independently evidenced.
Assurance status at a glance
CardIQ distinguishes implemented product controls from contractual commitments and independent assurance. Buyers should not infer one from another.
| Area | Current status | Procurement interpretation |
|---|---|---|
| Application security controls | Implemented controls documented | Review documented RBAC, MFA, audit, lifecycle, tenant-scoping and verification controls. |
| Hosting / data location | Deployment-dependent | Region, topology, residency and responsibility model must be confirmed for the proposed deployment. |
| SLA / RTO / RPO / backup commitments | Not implied by public documentation | Treat as contract-specific until formally agreed. |
| DPA / subprocessor schedule | Customer-specific due-diligence item | Request the current contractual/privacy package rather than assuming a public register exists. |
| Independent penetration test | No public independent-attestation claim on this page | Do not treat internal testing or repository tests as an independent pentest. |
| ISO 27001 / SOC 2 | No certification claim | Certification must be verified from an actual valid certificate or attestation before being represented as achieved. |
Implemented security and governance controls
Authentication and session security
CardIQ includes password/session controls, login activity, session revocation and administrator TOTP MFA foundations. Enterprise identity features remain subject to tenant configuration and documented availability boundaries.
Audit and security alerts
Identity and security-relevant actions can be recorded for authorized review. Security alerts and impersonation workflows are company-scoped and availability may depend on plan or configuration.
Lifecycle enforcement
Employee and company lifecycle controls can stop inactive identities from continuing to appear as active company-authorized identities.
Verification boundaries
Verification is company-scoped and deliberately narrow. CardIQ does not claim KYC, government-ID proofing, biometrics, deepfake detection, or guaranteed transaction authenticity.
Hosting, residency and deployment responsibility
The public documentation intentionally does not convert one deployment model into a universal hosting promise.
Managed SaaS
CardIQ operates the standard application service while customers administer company users, employee data, permissions and lifecycle decisions.
Dedicated cloud
Where offered, isolation, region, operational ownership, support access, updates and service levels must be documented in the customer agreement.
Self-hosted
Where offered, infrastructure responsibility shifts toward the customer and feature parity, support access, update process and operational obligations must be separately agreed.
This Trust Center does not promise a specific country/region, data-residency location, high-availability architecture, encryption profile, backup frequency, RTO, RPO or uptime percentage unless that commitment is explicitly documented for the customer.
Privacy, data processing and subprocessors
Privacy policy
The public Privacy Policy is the current general public privacy reference. Enterprise customers should reconcile it with the signed order, deployment model and any negotiated data-processing terms.
DPA status
This page does not represent that a standard public DPA has been executed for every customer. Where a DPA is required, it must be reviewed and agreed as part of contracting.
Subprocessor status
Do not infer a fixed public subprocessor list from application code. The applicable service providers and data flows should be disclosed for the actual deployment and contract before procurement approval.
Operational resilience and incident readiness
Procurement should separate technical controls from formal service commitments.
Backup and disaster recovery
A customer should request the backup, restore-test, retention, disaster-recovery and business-continuity commitments applicable to the proposed deployment. No universal RTO/RPO is asserted here.
Incident response
Security-event handling should be reviewed during enterprise due diligence, including reporting channels, triage, containment, customer notification obligations and post-incident review. This page does not invent notification timelines that are not contractually defined.
Vulnerability management
Repository tests, code review and internal security work are useful engineering controls but are not substitutes for a documented vulnerability-management process or independent security assessment.
Independent assurance and compliance boundaries
Penetration testing
Do not represent CardIQ as independently penetration-tested unless a current third-party report or attestation can be produced for the evaluated scope.
ISO 27001 / SOC 2
No ISO 27001 or SOC 2 certification/attestation claim is made by this page. A roadmap or control alignment is not equivalent to certification.
Customer regulatory obligations
Customers remain responsible for determining whether their use of CardIQ and selected deployment model meet their legal, regulatory, sector and geographic obligations.
Enterprise due-diligence checklist
1. Confirm deployment
Confirm SaaS, dedicated-cloud or self-hosted scope and the exact production responsibility model.
2. Confirm data flows
Document storage location, integrations, subprocessors/service providers, retention and support-access paths applicable to the customer.
3. Confirm contractual controls
Agree SLA, support, backup/DR, RTO/RPO, incident notification, DPA and security schedules where required.
4. Review assurance evidence
Request current pentest, certification, vulnerability-management and security-questionnaire evidence only where it actually exists; do not substitute marketing language for evidence.
Frequently asked questions
Is CardIQ ISO 27001 or SOC 2 certified?
This Trust Center does not claim ISO 27001 certification or SOC 2 attestation. Certification or attestation should only be represented when current evidence for the relevant scope is available.
Does the public website promise a specific hosting region, SLA, RTO or RPO?
No. Those commitments depend on the selected deployment and customer agreement and should be confirmed during enterprise scoping.
Does repository testing count as an independent penetration test?
No. Automated tests, code review and internal security work are engineering controls, but an independent penetration test requires a separate third-party assessment and report for a defined scope.
Control how employees represent your company externally
Explore the CardIQ Identity platform or review the workflow from verification through identity deactivation.
See how CardIQ Identity works View pricing