Tenant data segregation
Each institution works in its own workspace. Access rules are enforced at database level, so one organisation cannot read another's records.
Trust & security
Security built in from the first line.
How Pool Capital approaches data protection while the platform is in development and institutional pilot testing — stated plainly, without claims we cannot yet support.
01 · Design principles
What the platform is built around.
Role-based access
Users only see the modules and actions their role allows, from analysts to administrators.
Authenticated access
Every workspace and API call requires an authenticated session. There is no public access to pilot data.
Traceability
Key actions on transactions and documents are designed to be recorded, so teams can see who did what and when.
Data minimisation
During the pilot, partners are encouraged to start with fictional or anonymised data before sharing any real portfolio.
Separation of environments
Demonstration, sandbox and pilot workspaces are kept distinct and clearly labelled.
02 · Work in progress
What we are putting in place before production.
Pool Capital does not currently hold any security certification. The items below are planned steps, not completed audits.
- Formal information security policy and incident response procedure
- Independent penetration testing before any production use
- Data processing agreements with pilot partners
- Published list of sub-processors and hosting arrangements
- Assessment of relevant frameworks with advisers (e.g. GDPR obligations, DORA expectations for financial counterparties)
03 · DORA readiness
Preparing for the Digital Operational Resilience Act.
Regulation (EU) 2022/2554 applies to financial entities and shapes what they expect from ICT providers. This is our working readiness map, not a compliance statement.
| DORA pillar | Our approach | Status |
|---|---|---|
| ICT risk management | Documented architecture, access model and tenant segregation | In progress |
| Incident reporting | Incident response procedure and client notification process | Planned |
| Resilience testing | Independent penetration testing before production | Planned |
| Third-party risk | Sub-processor register and contractual clauses for clients | In progress |
| Information sharing | Security contact and coordinated disclosure channel | Planned |
04 · Due diligence
Reviewing Pool Capital as a counterparty.
Risk, compliance and IT teams can request a working session to review our architecture, access model and roadmap. Pool Capital is a technology provider — not a bank, fund manager, broker or regulated investment firm.