Skip to main content
FraudTrace AI is built specifically for regulated financial institutions — banks, PSPs, wallets, and fintechs — that require thorough third-party vendor security documentation before onboarding any API provider. This page summarises our compliance posture, technical controls, and how our platform is designed to support your internal information security reviews.

​
Compliance Posture

Every control listed below applies to the FraudTrace AI platform in its entirety, including the API, infrastructure, internal tooling, and data pipelines.

SOC 2 Type II

In Progress — Q3 2026 targetAudit scope covers the Security, Availability, and Confidentiality trust service criteria. Pre-audit controls are in place and operating.

ISO 27001

Controls aligned — certification in scope for 2026Our information security management practices are aligned with ISO 27001 requirements. Formal certification is planned for 2026.

DPDP Act 2023

CompliantFraudTrace AI does not collect or process the personal data of bank customers or payment recipients. See Data Handling for a full breakdown.

RBI Cyber Security Framework

AlignedAPI design, access controls, and audit logging are aligned with RBI guidelines for third-party API integrations at regulated banks and NBFCs.

Data Residency

India only — AWS Mumbai (ap-south-1)All data is stored and processed exclusively within Indian cloud infrastructure. No data leaves Indian jurisdiction.

PII Minimisation

By designOnly fraud-actor UPI VPAs are indexed. FraudTrace never stores victim or bank-customer personal data at any point in the pipeline.
If your information security team is conducting a third-party vendor risk assessment, share this page and the Data Handling page directly. Together they cover the most common questionnaire categories: data residency, PII handling, encryption, access controls, and compliance certifications.

​
Technical Security Controls

The following controls are active across all environments and apply to every API request you make.

​
Encryption

​
Authentication and Access

FraudTrace AI uses Bearer token authentication. Your API key is included in the Authorization header of every request. Keys can be rotated on demand — contact support@fraudtraceai.com to request a rotation. The old key is invalidated immediately upon rotation. Internal systems use role-based access control (RBAC). No engineer has standing write access to production data stores; access is granted on a just-in-time basis with a full audit trail.

​
Audit Logging

Every API request you make — including the full request payload and the response — is captured in an immutable audit log. Logs are timestamped, tamper-evident, and retained for compliance purposes.
FraudTrace API response objects — including the confidence_score, cluster_id, fraud category, and evidence source references — are designed to be stored directly in your own systems as part of your regulatory audit trail. Regulators and internal audit teams can then trace any mule-account action back to the underlying API evidence.

​
Infrastructure and Perimeter

  • Rate limiting is enforced on all API endpoints to prevent abuse and credential-stuffing attacks.
  • Anomaly detection monitors for unusual request patterns across all client accounts.
  • Infrastructure is hosted on AWS Mumbai (ap-south-1) with no cross-region data replication outside India.

​
Responsible Disclosure

If you discover a potential security vulnerability in FraudTrace AI’s API, infrastructure, or documentation, please report it responsibly. The FraudTrace security team reviews all incoming disclosures promptly and will keep you informed throughout the investigation. Contact: security@fraudtraceai.com Please include a clear description of the issue, steps to reproduce, and any supporting evidence (screenshots, request/response logs). We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.