How duely protects compliance records

Each user's role decides which workflows they can open. Suspicious matter handling is restricted to AMLCO-authorised users. Standard users see no suspicious matter indicators on shared engagement screens, notifications or exports.

• Engagement access scoped to your firm, with AMLCO and Approver policies controlling sensitive actions
• Admin and AMLCO role overrides with full audit logging
• Permission flags for access to sensitive data
• Role assignments managed at the firm level

duely protects data in transit and at rest, limits who can see it, and keeps evidence linked to the right engagement record. Sensitive documents and workflow records are governed by access controls and export rules suited to the context.

• Data protected in transit and at rest
• Separate permission flags control access to sensitive information
• Configurable export rules for different contexts
• Evidence linked to the correct engagement record

Evidence packs are versioned and integrity-hashed, so firms can verify that an exported record has not been altered since it was generated. The audit history and export details make later review easier.

• SHA-256 hashing applied to every evidence pack version
• Tamper detection by comparing an exported pack's hash with the one duely recorded
• An exported pack's hash can be checked at any time. A matching hash shows the pack is unchanged, not that its content is accurate.
• Each version is independently SHA-256 hashed for per-version tamper detection

duely supports your firm's tipping-off controls with layered access controls, each enforced at a different read or write path. They are: a separate shadow case object, AMLCO-only role-based access, redaction of unusual activity reports (UARs) for staff who raise them, no suspicious matter report (SMR) indicators on shared screens, evidence pack redaction, notification isolation, and filtered reads of the audit log. The controls are independent, so a mistake at any one of them should not expose SMR data on its own. Responsibility for preventing tipping off stays with your firm and its AMLCO.

• Shadow case stored as a separate record, not a flag on the engagement
• AMLCO-only policy enforced at every SMR API endpoint
• UAR submitters never see whether their flag became an SMR
• No SMR indicators on dashboards, lists, exports or notifications
• Evidence packs (both Standard and AMLCO-only Sensitive) never include SMR data
• Notification queue rejects SMR templates from non-AMLCO callers
• Audit events stay in the same append-only stream but are filtered from non-AMLCO reads

An append-only event stream records every action taken on every engagement. Within the application, entries are added, not edited or deleted. The log is held while your firm subscribes and stays read-only after your subscription ends; it is deleted with your firm's other data, after we email your administrator at least 30 days' notice. Within the application, suspicious-matter events are shown only to your firm's AMLCO.

• Append-only within the application: entries are added, never edited or deleted
• Every engagement action recorded with timestamp, actor and detail
• Record of every compliance decision and change

All data is encrypted at rest and in transit. Secrets are kept apart from application code, so credentials never appear in source, configuration or logs.

• Data encrypted at rest
• TLS 1.2 or higher for all data in transit, with TLS 1.3 preferred
• Secrets isolated from application code and excluded from logs
• Production credentials are not visible to engineers in day-to-day workflows

duely supports OIDC single sign-on, so your firm can manage access through its existing identity provider. Staff are added and removed the way your IT team already onboards and offboards them.

• OIDC SSO with standard OAuth 2.0 / OpenID Connect flows
• Centralised access control through your firm's identity provider
• Supports staff onboarding and offboarding workflows
• Multi-firm membership: one identity can belong to multiple firms with active firm context tracked per session

An approver can approve only while their own personnel due diligence (PDD) is current. If their AML training and screening are not current, duely refuses the approval.

• Engagement approval is refused when the approver's PDD is not current
• A 14-day grace period applies before a lapse blocks approval
• Logged warnings when blocked actions are attempted
• Only staff whose training and screening are current can make AML decisions

Notifications go out by SMS, email and in-app message. On every channel, only AMLCO-authorised users receive messages that relate to an SMR.

• Each template is sent by SMS, email or in-app message
• SMR-restricted templates blocked at the queueing layer for non-AMLCO callers
• AMLCO-targeted publishers fan out only to AMLCO recipients
• Optional daily digest

The platform is hosted in Australia, and engagement records, documents and evidence packs are stored here. Identity verification runs in the EU, with transfers to other countries including the United States under standard contractual clauses, screening in Switzerland and the EU, and AI features with a provider that stores data in the United States and may process it in other countries where it runs its models. The results are stored in Australia. Platform email is stored in the United States, and error monitoring in Germany with sub-processors in the United States. Our Data Processing Agreement lists the providers that process customer verification, screening and AI data and where they process it, and our Privacy Policy covers payments and website analytics.

• Engagement, document and evidence data hosted and stored in Australian data centres
• Identity verification in the EU (with transfers to other countries including the United States under standard contractual clauses), with the face template deleted with the session, about one month after the check
• Screening data held for the request, or while a person is monitored
• AI features: data stored in the United States and deleted within 30 days, unless the provider must keep it longer to enforce its usage policy or to comply with the law
• Platform email stored in the United States; error monitoring stored in Germany

Engagement records and evidence are retained in line with the firm's compliance obligations and internal controls. duely records the retention anchor date and its reason for each engagement.

• 7-year retention period (a legal requirement) shown from the anchor date recorded when an engagement is concluded
• The anchor is set once; reopening an engagement clears it, and the audit log keeps the history
• Anchor reason documented for each engagement's retention period
• Supports AML/CTF Act record-keeping obligations