Platform access
Scoping a mandate, confirming controls, and standing up coverage.
Operator deskSecurity & compliance
Control frameworks, review requests, and responsible disclosure.
Risk functionReporting & audit
Record format, retention and anything your auditors need from us.
Controls teamEverything else
Partnership, press, or a question that does not fit the boxes above.
CompanyWhat to put in the message.
The more concrete the context, the shorter the path to a useful answer.
What you are responsible for
The mandate, the book, or the number you answer for.
What constrains you
Custody requirements, jurisdiction, control framework, reporting obligations.
What would have to be true
The thing you would need to see before this could be approved internally.
Who else is involved
Whether risk, compliance or audit need to be in the first conversation.
Four steps, no funnel.
There is no drip sequence behind this form. It routes to a person.
Acknowledged
Your enquiry is logged against a named owner on our side.
Triaged
It goes to the desk that can actually answer it — operator, risk or controls.
Replied
A substantive response, typically within one business day.
Scoped
If there is a fit, we move to scoping the mandate in writing.
Found something? Tell us first.
We treat security reports as the highest-priority inbound we receive. Researchers who report in good faith will not face legal action from us.
How to report
- Use the form above and select “Security or compliance review”.
- Describe the issue, the impact, and how to reproduce it.
- Give us reasonable time to remediate before disclosing publicly.
- Do not access, modify or exfiltrate any data that is not your own.
For the people who have to sign off.
If you are reviewing us rather than buying from us, these are the questions we expect and answer directly.
Custody
We do not hold customer assets. Settlement destinations are nominated and controlled by the operator.
Record
Actions, decisions and declines are recorded as they occur, attributable and exportable.
Access control
Roles are separated, scoped to least privilege, and reviewed on a continuous basis.
Jurisdiction
Mandates respect the constraints of where the operator is permitted to act.
Retention
Records are retained for the period your obligations require, agreed during scoping.
Change control
Anything altering how your mandate executes is visible before it applies and recorded when it does.
Remote by construction, covered by design.
Our operating model mirrors the product: continuous coverage across time zones rather than an office with hours.
Americas
Coverage anchored across North and South American hours.
Europe, Middle East & Africa
Coverage anchored across European and Gulf hours.
Asia Pacific
Coverage anchored across East Asian and Oceanic hours.
Escalation paths are named per mandate during scoping, so an operator always knows exactly who to reach.
Before you write to us.
A short list, so nobody wastes a conversation discovering it.
Already know what you need?
Request access
Create an operator account and we will confirm scope before enabling anything.
Request accessOne conversation is usually enough to know.
Either the constraint we solve is your constraint, or it is not. We will tell you plainly which.