Security and compliance at Vault22
Vault22 is regulated by the FSCA in South Africa and the DFSA in the UAE. Our information security management system is ISO/IEC 27001:2022 certified, our controls are examined under SOC 2 Type II, and our systems are independently penetration tested. This page sets out how we protect customer data and how partners can request our evidence.
Last reviewed: · Owner: Security and DevOps · security@vault22.com
Regulatory status
Vault22 operates through two regulated entities. Each is licensed by the financial services regulator in its market.
| Entity | Regulator | Licence | Reference |
|---|---|---|---|
| 22seven Financial Services (Pty) Ltd, trading as Vault22 | Financial Sector Conduct Authority (FSCA), South Africa | Authorised financial services provider, Category I and II | FSP No. 55724 |
| Vault22 Financial Ltd | Dubai Financial Services Authority (DFSA), Dubai International Financial Centre (DIFC) | Category 4 licence, Retail Client Endorsement and Islamic Window Endorsement | FRN F006841 |
You can verify both entities on the FSCA FSP Register and the DFSA Public Register.
Certifications and independent assurance
Our security and compliance posture is examined by independent third parties. Summaries are public. Full reports and certificates are shared with partners under a non-disclosure agreement.
| Framework | Scope | Status | Evidence |
|---|---|---|---|
| ISO/IEC 27001:2022 | Information security management system covering the Vault22 platform, people and processes | Certified | Certificate and Statement of Applicability, under NDA |
| SOC 2 Type II (AICPA) | Trust Services Criteria for Security, Availability and Confidentiality, tested over an observation period | Report available | Full report, under NDA |
| Penetration testing | Independent manual testing of our mobile app and APIs, at least annually, with findings tracked to closure | A+ graded | Summary letter, under NDA |
| External cyber rating | Continuous external attack surface and cyber risk monitoring by an independent ratings provider | A band | Score summary on request |
| Data privacy | Alignment with POPIA (South Africa), GDPR (European Union), and DIFC DP Law 2020. | In place | Data processing agreement and privacy policy |
SOC 2 is an examination that produces a report, not a certification, so we describe it as a SOC 2 Type II report. Each item shows its report date or certificate validity, and we review this page before any of them lapse.
How we protect data
These are the practices behind our certifications and audits, described in plain terms.
Encryption
- Data in transit is encrypted with TLS 1.2 or higher.
- Customer data is encrypted at rest.
- Secrets are managed centrally, rotated and never stored in source code.
Access control
- Multi-factor authentication for all staff.
- Least-privilege, role-based access to systems and data.
- Access to production is logged and monitored.
Infrastructure and monitoring
- Segregated production environments with a leading cloud provider, managed as code.
- Continuous threat detection and endpoint protection.
- Centralised log monitoring and alerting.
Secure development
- Every code change is peer reviewed.
- Deployments are controlled and audited.
- Dependency and code scanning in our build pipeline.
Resilience
- Automated backups with point-in-time recovery.
- A separate disaster recovery region.
- Documented recovery objectives for partner integrations.
Governance
- Continuous compliance monitoring of our controls.
- A vendor and third-party risk management programme.
- Independent audits against ISO/IEC 27001 and SOC 2.
Bank connections and account data
Vault22 connects to your bank accounts with read-only access. We can see balances and transactions, but we can't move money, make payments or complete transactions from your bank account.
When your accounts update, Vault22 signs in to your bank on your behalf to fetch your latest transactions. Your bank may send you a one-time PIN or notification, the same as when you sign in yourself. You only enter your bank details inside the Vault22 app or web app, when you link an account.
If your bank isn't supported, you can add a manual account or import a PDF bank statement on the web app. Statements are encrypted in transit and at rest, and are only used to build your financial picture.
Client assets and investments
Investments are held in your name, with ABSA Investor Services as custodian, separate from Vault22's own accounts. Money only moves from your Vault22 wallet to our execution broker when you choose to invest.
Investing involves risk, and the value of investments can go down as well as up. Past performance doesn't guarantee future results. Tara gives general financial education, not specific investment advice.
Data protection and privacy
We process personal information in line with the Protection of Personal Information Act (POPIA) in South Africa, GDPR where it applies, and DIFC DP Law 2020 where applicable.
- Hosting: customer data is hosted with a leading cloud provider, with a primary region and a separate disaster recovery region.
- Retention: we keep personal information only for as long as we need it to provide the service, or for as long as financial services law requires.
- Your rights: you can ask to access, correct or delete your personal information, and object to direct marketing at any time.
- Complaints: you can contact us first, and you can also complain to the Information Regulator in South Africa, as well as the DIFC Commissioner of Data Protection.
- Partners: a data processing agreement is available on request.
Read the full Privacy Policy for how we collect, use and share personal information.
Subprocessors
These are the core providers that process data on our behalf. The full list and their data processing agreements are available on request.
| Provider | Purpose |
|---|---|
| Amazon Web Services | Cloud hosting and infrastructure |
| MongoDB Atlas | Managed database hosting |
| Google Workspace | Internal email and productivity |
| Datadog | Monitoring and logging |
| MoEngage | Customer messaging and in-app communication |
| Stripe | Subscription payments |
Evidence for banks and partners
Banks, partners and regulators can request our assurance pack under a non-disclosure agreement. Access is granted after a short review.
What you can request
- SOC 2 Type II report
- ISO/IEC 27001:2022 certificate and Statement of Applicability
- Penetration test summary letter
- Information security policies and data processing agreement
- Security questionnaire responses
Responsible disclosure
If you believe you have found a security vulnerability in Vault22, please tell us at security@vault22.com so we can investigate and fix it.
When you report an issue
- Give us reasonable time to fix the issue before you share it publicly.
- Don't access, change or delete data that isn't yours.
- Don't run denial of service, spam or social engineering tests.
- Include enough detail for us to reproduce the issue.
Our security contact details are also published at vault22.com/.well-known/security.txt.
About this page
This page summarises Vault22's security and compliance practices for customers, partners and regulators. It's general information and doesn't change our Terms of Service or Privacy Policy.
Last reviewed: . Owner: Security and DevOps. Contact: security@vault22.com.
Start with where you stand.
Create your free profile, link your accounts and see your whole financial picture. Choose a plan when you’re ready.