We move your data, never your money.
Acme is a non-regulated technology layer, not a bank. Your funds and bank accounts stay with you — we're the adapter that talks to each bank's system on your behalf. Here's how we protect the data and credentials that requires, and how we'll get you through your vendor review.
Money always flows directly between your bank accounts and your counterparties — never through Acme. We carry instructions and data, not funds.
How we protect your data
ISO 27001:2022 certified
Our information security management system is certified to ISO 27001:2022, and our controls are tracked in our Vanta Trust Center. We run regular risk assessments, periodic independent audits of our policies, and annual penetration tests.
Hosting & data residency
Hosted on AWS in Singapore. Data sits in Amazon RDS (PostgreSQL); AWS Security Groups filter inbound traffic and outbound traffic is allowed only to known IPs.
API keys & IP allowlisting
Every customer gets dedicated, scoped API keys, stored only as SHA-256 hashes. You can restrict keys to an IP allowlist that the API enforces on every request. Webhooks go only to HTTPS endpoints, signed with HMAC-SHA256.
Bank credentials & keys
You send credentials encrypted with a PGP key we issue at onboarding. Bank credentials, certificates and keys are stored in AWS Secrets Manager under AWS KMS, separately per customer and per bank.
Encryption
In transit: TLS 1.2 and 1.3 only, AES-GCM ciphers. At rest: AES-256, including backups, with keys in AWS KMS. Bank connections add what each bank requires — mutual TLS, PGP encryption and signing, X.509 XML signatures.
Access control & audit
The Acme Dashboard uses role-based access with MFA, account- and action-level permissions and maker-checker approval. Staff production access is limited to engineers via AWS single sign-on and logged in AWS CloudTrail.
Reliability & redundancy
Bank connectivity is our entire business — we're more incentivised to keep it running than an in-house team would be, and you'd run one code path either way. We monitor every connection and absorb bank changes before they reach you. Add a second or third bank on the same rail (built and tested before go-live). We've shielded customers through core-banking upgrades — including Standard Chartered's — with no customer-side downtime.
Vendor due diligence & SLA
We support vendor security assessments, questionnaires and SLA / uptime discussions as standard. Our ISO 27001 audit report, penetration test report and BC/DR tabletop exercise results are available on request. Tell us your requirements and we'll provide the documentation your risk and compliance teams need.
Request our security overview / start a vendor reviewFrequently asked questions
Security & access
Do you hold or touch our money?
No. Acme is a non-regulated technology layer, not a bank. Payments move directly between your bank accounts and your counterparties' banks. We carry only the instructions and data: payment instructions to your bank, and statements, balances and status back to your systems.
What certifications and audits do you have?
Acme is certified to ISO 27001:2022 — see the controls in our Trust Center. We also run regular risk assessments, periodic independent audits of our security policies, and annual penetration tests. Audit and penetration test reports are available on request.
How is our data encrypted?
In transit: TLS 1.2 and 1.3 only, with AES-GCM ciphers; webhooks are signed with HMAC-SHA256. Bank connections add mutual TLS, PGP or X.509 signatures as each bank requires. At rest: AES-256 in Amazon RDS, including backups, with keys in AWS KMS. Customer-managed keys aren't currently supported.
How do you handle our bank credentials and certificates?
You encrypt credentials with a PGP public key we issue at onboarding before sending them. They're stored in AWS Secrets Manager under AWS KMS, separately per customer and per bank. Only our application reads them at runtime; staff access is limited to engineering via single sign-on and logged in CloudTrail.
How are our API keys protected?
Each customer gets dedicated API keys, scoped to specific resources and read or write operations, and stored only as SHA-256 hashes. You can also restrict keys to an IP allowlist, which our API enforces on every request.
Who at Acme can access our data?
Access follows least privilege. Production access is limited to Acme engineers via AWS single sign-on, with actions logged in CloudTrail. Any database access, for example to troubleshoot an issue, is audited and recorded. All employees complete security training.
How do we control access for our own team?
The Acme Dashboard uses role-based access with MFA. Admins can limit each user to specific accounts and actions, require maker-checker approval on payments, and review a 60-day activity log.
Data storage & privacy
Where is our data stored?
On AWS in Singapore. Data is stored in Amazon RDS, encrypted with AES-256, and secrets in AWS Secrets Manager. Security Groups filter inbound traffic, and outbound traffic goes only to known IP addresses.
How is our data kept separate from other customers?
Isolation is logical: every API key belongs to one customer, and every query is scoped to that customer. Production logs hold IDs and statuses, not payment payloads. Raw bank messages are deleted after 14 days, and non-production environments use simulated data only.
How long do you keep our data?
• Statement, transaction and payment data: for the life of our relationship, then only as legally required (up to 6 years under Singapore law)
• Raw bank messages: 14 days
• Host-to-host/SFTP bank files: 18 months (statement files: 6 months)
• Application logs: 12 months
• Database backups: 14 days, encrypted
Can we ask you to delete or access our data?
Yes. We support deletion on verified customer request, in line with our agreement with you. Individuals can ask to access or correct their personal data by emailing our Data Protection Officer at support@tryacme.com.
How do you comply with data protection law?
Acme Technology Pte Ltd has taken steps to comply with Singapore's PDPA, as set out in our Privacy Policy below. If a data breach occurs, our Data Protection Officer will notify affected parties as soon as reasonably practicable.
Reliability, support & vendor review
Is Acme a single point of failure? What happens in a disaster?
Bank connectivity is our whole business, and we monitor every connection we run. You can also add redundant banks on the same rail. Live status is published at status.tryacme.com. Our BC/DR plan targets a 3-hour recovery time and 1-day recovery point, tested annually.
What uptime and support do you commit to?
Our SLA commits to 99.5% monthly uptime, excluding scheduled maintenance (at most 3 hours a month, announced a week ahead). We aim to resolve P0 issues within 6 hours, P1 within 10 hours and P2 within 48 hours. Full terms are in our SLA below.
How do you handle API changes and versioning?
The API is versioned as a whole (/v1). Backward-compatible changes ship without notice, so integrations should ignore unknown fields. Breaking changes happen only after consulting affected customers, with advance notice and migration guidance. See docs.tryacme.com/guides/api-compatibility.
Will you complete our security questionnaire?
Yes, as standard. Our ISO 27001 audit report, penetration test report and BC/DR test results are available on request. Talk to us about what your risk team needs.
How do I report a security concern or vulnerability?
Email support@tryacme.com with a description of the issue and the steps to reproduce it. The same address handles security questions and report requests.
Terms, policies & documents
The agreements and policies that govern how we work with you and handle your data. Our ISO 27001 audit report, penetration test report and BC/DR test results are available on request.