Security at Decisimo
Decisimo automates credit decisions. Start free, with account controls on every plan from the day you sign up. Data sent to a decision is not kept.
What happens to decision data
The data you send to a decision passes through to make it and is not retained by Decisimo. We never use customer data to train models. We keep your decision logic and its revision history, plus the portal audit log of who did what. Execution traces are written to infrastructure you control. That lets you reconstruct a decision later against the exact version of the logic that made it.
The practices we follow
We run information security to ISO 27001, the international standard for managing information security. The lines below describe what that means in day-to-day work.
- Data is encrypted in transit and at rest.
- Environments are kept separate, and portal activity is logged.
- Access rights are reviewed regularly. Staff have a duty of confidentiality, and their access is limited to what their work needs.
- If a personal data breach affects you, we tell you within 72 hours of becoming aware of it.
- At least 30 days' notice before adding or replacing a subprocessor. The list is available on request. See the data processing agreement.
Controls on every plan
No control is reserved for a higher tier, and you can switch them on when your account opens.
Single sign-on and two-factor
Use single sign-on with the identity you already manage, plus two-factor authentication for account access.
IP restrictions
Limit portal access to the networks you name. A valid login from another address is not enough.
Role access and sign-off
Give analysts and reviewers different access rights. An endpoint can carry a sign-off sequence, and a release is deployed only once signed.
Credential vault
Provider and bureau credentials are held in an encrypted vault with step-up authentication and key rotation. They point to your own contracts with those providers. Connect a data source.
Portal audit log
The audit log records every view, edit, test, export, deployment and login, with the person, IP address and correlation ID. You can read it.
Where it runs and taking it with you
Execution endpoints are regional, and you choose the region where decisions run. Decision logic and account data are held in the UK or the EEA. On request, an execution node can run in your infrastructure. The design stays in the portal. If you leave, results are in your database if you set up the sink, and you can export your logic as a Markdown file.
Questions we get asked
Does Decisimo store applicant data sent to a decision?
The data you send to a decision passes through to make it and is not retained by Decisimo. Execution traces are written to infrastructure you control.
Is our data used to train AI models?
Customer data is never used to train AI models, ours or anyone else's. Data sent to a decision is not retained by Decisimo.
Do SSO and two-factor cost extra?
Single sign-on and two-factor authentication are available on every plan. You can switch them on when your account opens.
Who at Decisimo can see our account?
Decisimo staff who can process customer data have a duty of confidentiality. Their access is limited to what their work needs.
How do I get a security questionnaire answered?
Send your security questionnaire to hello@decisimo.com and we’ll answer it. The governance page maps DORA and the EU AI Act to what each asks a lender to evidence.
Try your policy in Decisimo
Start with your own policy, then switch on the account controls you need.