Security controls you can evidence to a regulator
What we do to keep sanctions data current, customer data separated, and every action on record. We only list what is implemented in the product.
Data freshness and system status
Each sanctions list is fetched on a daily schedule. The table below is read from our import records each time this page loads.
| List | Last updated | Entries | Last import |
|---|---|---|---|
| Australian Sanctions | 11,414 | Success | |
| Canadian Sanctions | 1,602 | Success | |
| EU Sanctions | 6,234 | Success | |
| OFAC (US) | 19,471 | Success | |
| UK Sanctions | 6,408 | Success | |
| UN Security Council Resolutions | 1,010 | Success |
The service is monitored continuously by external uptime checks. We do not publish an uptime percentage on this page.
How the platform protects your data
Organization-scoped tenant isolation
Screening data is accessed through services that require an organization ID and filter every query by it, so one customer's records are not visible to another.
Role-based access control
Permissions are assigned through roles within your organization, so team members see and do only what their role allows.
Tamper-evident audit trail
Audit entries are linked with SHA-256 hash chaining, and the chain can be re-verified to detect altered or removed records.
Token-authenticated API with PII-safe responses
The screening API requires a token and is scoped to the caller's organization. Result lookups return status and outcome only, and leave out entity names, matched names, aliases, and hit details.
Daily sanctions list updates
A scheduled job refreshes all sanctions lists once a day, and every import is recorded so the freshness table above reflects real results.
Read-only regulator portal
Regulators can be invited with token-based access and a defined scope (full, masked, or summary), with personal data masking applied for the narrower scopes.
Iris offers a Sovereign Compliance plan with local settlement in ZiG or USD. If you have data residency or deployment requirements, contact us and we will discuss what applies to your case.
Responsible disclosure
If you believe you have found a security issue, please email support@iris.s42.xyz with the details and steps to reproduce. Please do not access other customers' data or disrupt the service while testing.
Read the Iris disclaimer for the limits of what screening results can and cannot tell you.