Security and compliance

Reference frameworks

The platform follows the controls defined by the ISO 27001 and SOC 2 frameworks as a reference for its security practices. Guardline is not certified under these frameworks, but adopts their controls as the basis for implementing its internal policies and processes.

Data isolation

The Guardline Suite operates in a single-tenant model. Each institution receives dedicated database and cache instances. There is no sharing of storage or processing infrastructure between tenants.

For institutions with data residency requirements, the platform can be deployed in a specific geographic region or in the institution’s internal environment (on-premise).

Data protection

• LGPD: personal data processing follows the principles and obligations of the Lei Geral de Proteção de Dados Pessoais, Brazil’s data protection law.
• Immutable audit trail: every operation performed on the platform is recorded in an immutable log, accessible to the institution for audit and regulatory compliance purposes.
• Profile-based access control: access to features and data is segmented by user profile, module, and operation. The institution configures the profiles according to its organizational structure.
• Session and password policies: the institution can configure session expiration policies, password complexity requirements, and lockout after invalid attempts.

Authentication

The platform supports local authentication and Single Sign-On (SSO) through two protocols:

• SAML: integration with corporate identity providers that use the SAML 2.0 standard.
• OpenID Connect: integration with identity providers compatible with OpenID Connect.

The institution can choose to use SSO exclusively or in combination with local authentication, according to its access policy.

Regulatory compliance

The platform implements controls and features designed for compliance with the following regulations:

• BACEN Circular 3.978: AML/CFT procedures, customer identification and qualification (KYC), transaction monitoring, and communication to COAF.
• COAF resolutions: reporting deadlines and formats, and record retention as required by the regulator.
• LGPD: processing, storage, and protection of personal data in accordance with Brazilian law.
• FATF recommendations: adoption of practices aligned with international standards for the prevention of money laundering and terrorist financing.

The decision engine is configurable by jurisdiction, allowing the institution to adapt rules and flows to the regulatory requirements of each country or operation.