-
Usulid security posture
at
Security One-Pager • Customer-Facing

Usulid security posture

Procurement-ready overview: data types, controls, subprocessors, retention, and incident response.

Request DPA + Security Packet
Book a 15-min walkthrough

Hosting & infrastructure

Regionalized for EU operations.

Compute

Firebase Functions — Google Cloud Europe West Region.

Storage

Firebase Storage — Google Cloud Europe West Region.

Authentication

Firebase Auth — corporate email login only (domain allowlist).

What we handle

We aim to minimize sensitive data and keep customers in control.

Account data

Name, business email, role, tenant metadata.

Move metadata

Event type, timestamps, risk tier, reviewer notes.

Customer documents

Optional; controlled by customer policy and workflow.

Core controls

High-level controls most reviewers require.

Access & isolation
Tenant isolation boundaries
Role-based access (RBAC) for moves and evidence
Corporate email only (domain allowlist) to prevent consumer accounts
Least-privilege connector scopes
Encryption
TLS in transit
Encryption at rest via Firebase/Google Cloud managed encryption
Encryption keys are managed by Google Cloud; customer-managed keys are not currently offered.

Logging, audit, and retention

Evidence-first with a defensible trail.

Audit trail

Move create/edit, uploads, approvals, and key actions with timestamps.

Retention

Configurable retention. Deleted data removed from active systems and ages out from backups per schedule.

Monitoring

Google Cloud Logging (alerts on errors/unusual patterns).

Subprocessors

Core subprocessors and customer-authorized integrations.

Google Cloud / Firebase (hosting + storage) — Europe West region
Customer-authorized integrations: Google Workspace APIs / Microsoft Graph (if enabled)
Monitoring: Google Cloud Logging
Analytics (optional): None configured
Full subprocessor list and technical measures are included in the DPA/security packet.

Incident response

Clear process and timely notification.

Triage → containment → eradication → recovery → postmortem
Customer notification without undue delay per contract and applicable law
Root cause analysis for material incidents impacting customer data
Security contact:security@usulid.com
Sign-up
Book a 15-min consultation
See your top 3 KYC event types mapped in 12 minutes.
Capital calls • Direct equity • Third-party payer • New counterparty
Book a 15-min walkthrough