# Open-source ledger infrastructure you can trust   - Blnk Finance is ISO-27001 certified and compliant with GDPR rules and regulations. - We ship best practices and tools to maintain security across all levels of our product. - Trusted by regulated institutions, public companies, and startups. Practices - [01 Compliance](#compliance) - [02 Infrastructure](#infrastructure) - [03 Product](#product) - [04 Availability](#availability) ## Compliance How Blnk runs its ISMS: ISO/IEC 27001, GDPR, data protection, security training, background checks, access control, and incident response.  ### ISO/IEC 27001-certified Blnk’s ISMS is certified to ISO/IEC 27001. It defines access control, incident handling, risk treatment, and the review cycle for those controls. [Request certification](mailto:sales@blnkfinance.com?subject=Request%20ISO%2FIEC%2027001%20certification)  ### GDPR-compliant Personal data is processed under GDPR. The [Privacy Policy](https://blnkfinance.com/legal/privacy) covers lawful basis, retention, and subject-access requests. ### Data protection Personal data is classified and accessed on a need-to-know basis. Blnk keeps only what the work requires. For example, a support ticket does not grant access to identity PII unless the role allows it. ### Policies and governance Written policies cover information security, access control, incident response, and business continuity. Management reviews and approves them on a set schedule. ### Risk assessments Blnk assesses risks to confidentiality, integrity, and availability, then tracks remediation until each finding is closed. ### Training All employees at Blnk complete annual security training based on their roles. The information security team also reaches employees through internal email campaigns and gamification. ### Background checks Blnk conducts background checks on all applicants selected for full-time employment, in compliance with local regulations. ## Infrastructure How Blnk isolates production systems, encrypts data in transit and at rest, and controls access to critical services. ### Dedicated Production infrastructure Production runs on dedicated hosts, not shared Sandbox capacity. Customers choose the region their instance runs in at deploy time. ### Network isolation Inbound traffic to a managed instance is limited to the customer IP allowlist. Self-hosted Blnk behind a firewall can also allowlist Blnk’s egress IPs so the dashboard safely reaches the API. ### Encryption in transit and at rest Blnk encrypts data at rest and in transit. Sensitive data at rest, including API keys, is encrypted with AES-256-GCM. Data in transit uses TLS 1.2 or higher. ### Access control Critical services follow password policies. Access is granted only through SSO or multi-factor authentication, where available. The information security team runs periodic user access reviews of authorization and permissions. ## Product An append-only ledger, scoped API keys, workspace roles, multi-factor authentication, PII tokenization, and audit logs. ### Immutable ledger Blnk records transactions as an append-only log. Entries are not updated in place, and identity changes are logged. Balances are reconstructed from that history rather than from a mutable total. ### Scoped API keys Each API key in Blnk is limited in scope. A key can access only certain resources and can perform only certain operations on them (read or write). For example, a payments key can be created that only writes transactions, with no access to ledgers or API keys. ### Expiration and revocation API keys in Blnk can be set to expire, and can be revoked immediately. Lost keys cannot be retrieved. A key is rotated by creating a new key and revoking the old one. ### Roles and permissions Blnk includes built-in roles and permissions for workspace members: Admin, Operator, Investigator, and Analyst. Analyst is read-only. Access is granted on a need-to-know basis, in accordance with least privilege. ### Two-factor authentication Blnk supports multi-factor authentication through TOTP and an authenticator app. Sessions record device, location, and time. A session can be revoked from Security & Access, and a new sign-in sends an email. ### PII tokenization Blnk tokenizes personally identifiable information on identity records so sensitive values are not stored in plaintext. Standard tokens are random, and format-preserving tokens keep the original shape. Detokenization is permissioned and logged. ### Audit logs Blnk collects audit logs for workspace activity: the action, who performed it, and when. Logs cover ledgers, balances, transactions, identities, and anomaly reviews, and are used to review activity and identify unusual or unauthorized actions. ## Availability Availability practices, backups, public status updates, and incident response and management. ### Uptime Blnk maintains uptime targets for systems that handle customer operations. Production is covered by a 99.9% uptime SLA. Sandbox is not covered by an uptime or retention SLA. ### High availability and backups Blnk runs systems with high availability and scheduled backups. Backups are written to disk or S3-compatible storage with server-side encryption, versioning, and a configured retention policy. ### Regions Systems and their backups are kept in the region selected for that environment, so data stays in that region. ### Status Blnk monitors availability and posts incident updates to [status.blnkfinance.com](https://status.blnkfinance.com) as they happen. ### Incident response Blnk maintains incident response and management procedures as part of the ISMS. SEV 1 incidents are covered by 24/7 on-call, and restore procedures are documented. Incident communication can include a dedicated Slack channel. ## Ask for a report or disclose a bug Email [support@blnkfinance.com](mailto:support@blnkfinance.com) for policies, audit reports, or questions about these controls. To report a vulnerability, use the [disclosure form](https://blnkfinance.com/report-vulnerability).