Security, privacy, and resilience at Falcon Veritas Intelligence.

The FVI multi-tenant SaaS control plane and data plane, covering the Security, Availability and Confidentiality Trust Services Criteria. Privacy and Processing Integrity are not currently in scope of the planned attestation.

• Draft control matrix (TSC → FVI control) available under NDA
• Auditor-facing artefacts: access-review logs, change tickets, vuln scans, on-call records
• Type I / Type II reports will be published to Tier-1 tenants when issued

• Operate the SOC 2 control framework, including change management, access review, monitoring and incident response
• Retain control evidence continuously so the auditor observation window is uninterrupted
• Engage an AICPA-registered CPA firm for the Type I and Type II attestation

• Configure SSO, RBAC and least-privilege inside your tenant per your own SOC 2 scope
• Review the SOC 2 report annually as part of your vendor-risk file
• Report suspected control failures via the documented incident channel

The FVI ISMS covering the design, development, operation and support of the reconciliation platform and the personnel and systems supporting it. Statement of Applicability targets all 93 Annex A controls with documented exclusions where appropriate.

• ISMS policy pack (Information Security, Access Control, Cryptography, Supplier, Incident, BCM)
• Risk register and treatment plan sample under NDA
• Certificate and Statement of Applicability will be published upon issuance

• Maintain the ISMS: risk register, Statement of Applicability, internal audit, management review
• Operate Annex A controls (A.5–A.8) with documented policies and evidence of effectiveness
• Engage an accredited certification body for Stage 1 and Stage 2 audits

• Maintain your own ISMS for the customer side of the shared-responsibility boundary
• Provide security requirements in the contract so FVI can flow them into its own SoA

FVI acts as a data processor on documented tenant instructions for all personal data processed inside the tenant boundary. Applies to EU/UK personal data regardless of tenant home region, with SCCs and UK IDTA as required.

• DPA template with SCCs, IDTA and sub-processor register
• Records of Processing Activities extract relevant to your tenant
• Transfer Impact Assessment supporting materials on request

• Provide a DPA with Standard Contractual Clauses and the UK International Data Transfer Addendum
• Assist with data-subject requests, DPIAs and regulator engagement within statutory windows
• Notify controllers of a personal-data breach without undue delay (target ≤ 72 hours)

• Act as controller: determine lawful basis, purpose and retention for personal data
• Configure retention, PII masking and access controls consistent with your privacy notice
• Handle data-subject communications with the individuals concerned

FVI as an ICT third-party service provider to EU-regulated financial entities. Covers Chapter II (ICT risk management), Chapter III (incident reporting support), Chapter IV (digital operational resilience testing) and Chapter V (third-party risk, Articles 28–30).

• DORA contractual addendum with Article 28 & 30 clauses
• Register-of-information data pack (JSON + CSV) matching the RTS templates
• Exit plan, BCP/DR test evidence and sub-processor change-notification workflow

• Include DORA Article 30 mandatory clauses in the standard Order Form / MSA
• Support your ICT third-party register with LEI, function criticality and substitutability inputs
• Cooperate with competent authorities, participate in TLPT where the tenant is in scope

• Classify the FVI service in your Important Business Service catalogue and set Impact Tolerances
• Register FVI as an ICT third-party (and, if applicable, as supporting a critical/important function)
• Perform your own concentration-risk assessment across your ICT third-party estate

Applies where FVI processes risk-relevant data feeding books-and-records or regulatory reporting. Principles 3 (accuracy & integrity), 4 (completeness), 5 (timeliness), 6 (adaptability), 7 (accuracy of reporting) and 8 (comprehensiveness) are the primary design anchors.

• Lineage export per reconciliation run (source → normalisation → match → outcome)
• Signed hash-chain verification bundle for any window on demand
• Completeness and timeliness KPI reports through the analytics API

• Preserve end-to-end lineage from source ingestion to matched output in the hash-chained audit
• Provide reconciliation completeness and timeliness metrics per run
• Retain evidence for the tenant-configured period (default 7 years)

• Own upstream data quality and the definition of the risk data being reconciled
• Integrate FVI outputs into your risk-reporting and governance forums

All AI/ML models used by FVI that materially influence a reconciliation outcome: auto-mapping, fuzzy-match scoring, break-triage suggestions and any LLM used for extraction or narrative generation. Deterministic rule engines are treated as models where they drive automated decisions.

• Model documentation and validation pack per model version
• Explainability record for every AI decision inside the hash-chained audit
• Per-tenant model allow-list configuration and BYO-LLM routing evidence

• Maintain a per-model documentation pack: intended use, data, limitations, known failure modes
• Publish validation evidence: benchmarks, calibration, drift, champion/challenger comparisons
• Notify tenants of material model changes ahead of deployment

• Register FVI models in your own Model Inventory and set the appropriate risk tier
• Perform independent model validation to the depth your MRM policy requires
• Own the human-in-the-loop approval decisions inside the four-eyes workflow

Applies to Singapore-regulated FI tenants. Covers TRM sections on third-party risk, access control, cryptography, systems reliability, cyber-security operations and incident management as they relate to the FVI service.

• TRM control-mapping worksheet
• Incident-management runbook extract
• Residency confirmation letter for Singapore-pinned tenants

• Support MAS Notice 655 / 644 incident-notification timelines through the security channel
• Provide TRM-aligned control evidence and threat-model documentation on request
• Offer Singapore-region data residency where operationally available

• Complete your outsourcing risk assessment and notify MAS where required
• Configure access, encryption and monitoring inside the tenant per your TRM policy

Applies to APRA-regulated tenants (ADIs, insurers, RSE licensees). Focused on information-asset classification, control implementation commensurate with the criticality of information assets, testing of controls and incident notification.

• Control-testing summary aligned to CPS 234 paragraphs 20–26
• Incident-notification workflow with named APRA-liaison contact on your side

• Classify tenant information assets processed by FVI at the highest applicable sensitivity
• Test information-security controls on a defined cadence and share summary results
• Support APRA-required notification timelines (72 hours for material incidents)

• Maintain your own CPS 234 information-security capability and Board reporting
• Notify APRA of material information-security incidents affecting your entity

Continuity of the FVI reconciliation service for enterprise tenants, including cross-AZ high availability by default, cross-region DR on request, and personnel / supplier continuity for the FVI operating team.

• BCMS policy and BIA summary
• Most recent DR-drill and BCP-exercise reports (redacted, under NDA)
• Documented Exit Plan with data-return format and timeline

• Maintain a BCMS with Business Impact Analysis, risk assessment and continuity plans
• Execute quarterly DR drills and an annual full-scenario BCP exercise
• Publish RTO ≤ 1 hour and RPO ≤ 5 minutes targets and report against them

• Include FVI in your own BCP scenarios and confirm your side of the runbook
• Nominate BCP contacts on both sides for invocation and communications

Out of scope. FVI is not designed as a Cardholder Data Environment (CDE) and does not accept, store, process or transmit Primary Account Numbers (PAN) or Sensitive Authentication Data.

• Statement of non-applicability available on request

• Design controls to keep the service out of the CDE
• Provide guidance on tokenising PAN upstream before ingestion

• Do not send PAN or SAD to FVI; tokenise or truncate before ingestion
• Handle any PCI-DSS obligations inside your own CDE, not inside FVI

Out of scope. FVI is not offered as a HIPAA Business Associate and does not sign Business Associate Agreements. The service should not be used to process Protected Health Information (PHI).

• Statement of non-applicability available on request

• Decline BAA requests and clearly communicate non-applicability

• Do not process PHI in FVI; use a HIPAA-covered service for that workload