API documentation

Security overview

The security posture of the Stonewake platform, for an enterprise IT review, on one page. The product needs no data from your bank. It works on public and licensed external sources, nothing is installed on your side, and every access path is HTTPS only. This page covers the service as your teams use it in the browser; the programmatic surface has its own page under API security.

Hosting and encryption

  • The database, the API, the audit trail and the MCP server run on a dedicated server of a German provider in Helsinki, Finland. The web pages of the dashboard, the documentation and the website are delivered by Vercel, a US company, over its global delivery network, which also runs the request routing step of the website. All other server functions of the three run in its Frankfurt region. Sign-in runs through a managed service in London.
  • All traffic is TLS only, and the dashboard ships strict security headers on every response, namely a content security policy, frame denial, strict transport security, and content-type protections, verifiable from any browser. Frame denial holds for every page except a workspace's embed address, which only the SharePoint sites listed by that workspace's administrator may frame (see SharePoint).
  • Data is encrypted in transit and at rest. Database backups are encrypted, held apart from the production server, and kept for a defined retention window; restore procedures have been exercised.

Access and identity

  • Sign in is by work email and password, through a managed authentication service. A new login receives a link to set its own password, and no password is ever sent by mail. The link works once and for one hour. A forgotten password is reset through a new link from your Stonewake contact. Access tokens expire after one hour and are renewed only for an active session. A session ends at sign-out. An account an administrator removes can no longer sign in or renew its token, and its access ends within at most 60 minutes, when the access token it already holds expires.
  • Single sign on is switched on per workspace by arrangement. It federates to your own identity provider over SAML 2.0, and the supported provider is Microsoft Entra ID. With single sign on, your identity team keeps control of credentials, MFA, and conditional access, and an account only ever lands in the workspace that owns its email domain. See Single sign on.
  • Workspace access is role based (viewer, analyst, compliance, and admin), least privilege by default, and every grant is made by a named administrator. Our own operator functions sit behind a separate operator privilege that no customer account holds, administrators included.

Isolation and auditability

  • Each institution has its own isolated workspace. Tenant isolation is enforced at three independent layers, down to row-level security in the database.
  • Actions on workspace data land in an append-only audit trail attributed to the acting user; the database refuses updates and deletions of audit entries from the application.
  • We store your workspace records (deals, screenings, review decisions and exports) on our infrastructure and do not train models on them. Search queries, fetched public text and the text sent to AI providers for drafting, including the subject of a screening, are processed by search and AI providers under the terms in the privacy policy, sections 7 and 8.
  • Research content is AI-assisted, disclosed as such in the product, grounded in cited sources, and meant for review by your analysts. Scores apply to organizations and countries, never to natural persons. No endpoint serves a person level score, and the build fails if one appears. Our classification under the EU AI Act is on the AI Act page.

Vulnerability management

  • Our release gate includes automated dependency audits over the backend and the dashboard dependency trees and a secret scan over the full repository history.
  • Report suspected vulnerabilities to contact@stonewake.ai with "Security" in the subject; scope, safe harbour and response times are on the security disclosure page.

See also Enterprise onboarding, Data handling, Accessibility, the privacy policy, and the data processing agreement provided to customer banks.